Calif, a security research firm, has published details of a vulnerability in OpenBSD that traces back roughly 37 years to the original BSD sources. A shared memory attachment counter was defined as a signed 16-bit short. Repeatedly forking a process with shared memory attachment records could push that counter past its maximum value of 32,767, causing it to wrap to a negative value. This integer overflow could lead to a use-after-free via a race condition. Combined with a separate out-of-bounds write in the kernel, it allowed local privilege escalation to root. The issues were addressed in errata 026 and 018.
The researchers described an exploit path that achieved local root on OpenBSD with KARL, SMAP and SMEP enabled, without using an information disclosure vulnerability. The method involved mapping 127 System V shared memory segments, unmapping them, and forking 259 processes to wrap the attach count. Heap grooming and a race condition were then used to align allocations, corrupt a multicast structure, and ultimately gain kernel code execution by overwriting a predictable kernel pointer.
The exploit relied on a write-what-where primitive, where the write came from a TAILQ_REMOVE operation, the target was userland memory made supervisor-accessible, and the location was a predictable kernel pointer. OpenBSD's KARL randomizes function and data addresses, but the kernel's memory allocators remain deterministic, which made certain early boot allocations reliable targets.
To reduce the risk of similar attacks, the authors suggest measures such as safe-unlinking, which checks doubly linked list invariants before performing unlink writes and aborts or panics if they are violated. Calif said it regularly reports vulnerabilities to open source projects, often with suggested patches.
Source: Hacker News · Summarized by HeadlinesBriefing