{"id":3591,"date":"2026-10-16T19:07:16","date_gmt":"2026-10-16T19:07:16","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3591"},"modified":"2026-10-16T19:07:16","modified_gmt":"2026-10-16T19:07:16","slug":"researchers-demonstrate-openbsd-root-exploit-chaining-37-year-old-shared-memory-bug","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3591","title":{"rendered":"Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Oct 16, 2026<\/span><\/span>Vulnerability \/ OpenBSD<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD’s KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup<\/a> and full proof-of-concept code after OpenBSD shipped patches for both issues in September.<\/p>\n

The integer overflow in the shmat(4) attach function was fixed in errata 018<\/a>, shipped September 14 as a reliability fix. The reference-counting use-after-free that completes the chain was fixed separately in errata 026, shipped September 30 as a security fix.<\/p>\n

Both are available through syspatch<\/code> and cover all architectures. OpenBSD 7.8 also received the integer-overflow fix.<\/p>\n

The integer overflow, the entry point for the full chain, is classified as a reliability fix, not a security fix.<\/p>\n

No CVE has been assigned for either flaw as of publication. There is no evidence that the vulnerabilities have been used in attacks.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The shared-memory attachment counter shm_nattch<\/code> is defined as a signed 16-bit short<\/code> with a maximum value of 32,767 in original BSD sources<\/a> dating to 1988. OpenBSD inherited the type and never widened it.<\/p>\n

The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum and wrapping it to \u221232,643. A race condition then triggers a use-after-free: the corrupted reference count causes the kernel to free memory that other processes still use.<\/p>\n

A separate out-of-bounds write overwrites multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible and bypassing SMAP and SMEP. The exploit then overwrites a function pointer at a predictable kernel address to run its own code.<\/p>\n