Calif Demonstrates Root Exploit Chain Against OpenBSD 7.9
Security firm Calif has published proof-of-concept code for a local privilege-escalation chain that obtains root privileges on OpenBSD 7.9. The demonstration combines an integer overflow in the shmat(4) shared-memory attach path with a separate kernel use-after-free, and bypasses OpenBSD’s KARL address randomization as well as SMAP and SMEP hardware protections.
OpenBSD had already patched both flaws before the public write-up. Errata 018, released on September 14 as a reliability fix, addresses the integer overflow; errata 026, released on September 30 as a security fix, addresses the reference-counting use-after-free. Both updates are available through syspatch on all architectures. OpenBSD 7.8 also received the integer-overflow correction.
A legacy counter becomes the exploit entry point
The initial flaw lies in shm_nattch, the shared-memory attachment counter. It is a signed 16-bit short, retaining a maximum value of 32,767 from original BSD code dating to 1988. Calif said OpenBSD inherited the type and did not widen it.
The published exploit maps 127 shared-memory segments and forks 259 processes. That drives the counter beyond its maximum and wraps it to minus 32,643. A race condition can then activate the second flaw: a corrupted reference count leads the kernel to free memory still used by other processes.
How the chain defeats kernel protections
Calif’s chain uses a separate out-of-bounds write to overwrite kernel multicast-membership counters. When an affected socket closes, the resulting decrements alter page-table entries. The researchers describe this as changing a user-memory mapping to supervisor-accessible, allowing the chain to bypass SMAP and SMEP before it overwrites a function pointer at a predictable kernel address.
The exploit does not require an information-disclosure vulnerability. Researcher Andrew Griffiths noted that KARL relinks the kernel binary to randomize function and data addresses, but OpenBSD’s kernel memory allocators remain deterministic. The boot-time and best-fit allocators do not randomize base addresses, meaning early-boot structures, including function pointers in the lo0 and enc0 network-interface handlers, can occupy the same addresses after reboots on the same hardware.
Patch status and operational response
No CVE had been assigned to either issue when Calif published its report, and the firm said it had found no evidence of attacks using the vulnerabilities. Calif proposed safe-unlinking for kernel linked lists, randomization of the page-table self-referential mapping, kernel-allocator randomization and compiler-based bounds checking as hardening measures.
For organisations operating OpenBSD, the immediate business implication is to apply current syspatch updates across supported systems and ensure that kernel reliability errata are included in security patch triage, particularly where local access could be obtained.