Cybersecurity firm Calif has published a full exploit and write-up for a local privilege escalation on OpenBSD 7.9 that chains two kernel flaws, one of them a 37-year-old integer overflow inherited from the original BSD sources. OpenBSD shipped fixes for both flaws weeks earlier, but local attackers on unpatched systems can now obtain root using public code.
Calif’s OpenBSD 7.9 Exploit Bypasses KARL, SMAP and SMEP
The exploit chain gives a local attacker root access on OpenBSD 7.9. According to Calif, it bypasses KARL address randomization along with SMAP and SMEP protections, and it does so without needing an information leak. The write-up and exploit were published during the week of October 19.
The shm_nattch Integer Overflow Dating to 1988
The exploit chain starts with an integer overflow in code that dates back to 1988, and OpenBSD has already patched it.
How the 16-Bit Counter Wraps Negative
The first flaw sits in the shm_nattch counter, which BSD code defined in 1988 as a signed 16-bit integer with a maximum value of 32,767. An attacker can push the counter past that limit by mapping 127 shared memory segments and creating 259 processes through fork. The counter then wraps to a negative value, which causes a use-after-free condition through a race.
Errata 018 and Errata 026
OpenBSD already shipped fixes. Errata 018 addresses the integer overflow and was released on September 14. Errata 026 addresses the use-after-free and was released on September 30. Both are available through syspatch on all architectures.
Second Flaw: Out-of-Bounds Write on Multicast Membership Counters
The second vulnerability is an out-of-bounds write on multicast membership counters. It leads to modification of page table entries and gives supervisor-level access to user memory. Chained with the first flaw, it completes the path to root.
The reporting available does not list a separate errata number for the multicast flaw, and it names errata 018 and 026 as the available fixes for the issues in the chain.
The mechanics of the first flaw show how an old design choice becomes exploitable. A signed 16-bit integer holds values only up to 32,767. When the shm_nattch counter, which tracks attachments to shared memory, is forced past that value, it wraps around to a negative number, and the kernel then handles the segment incorrectly, producing the use-after-free through a race.
Calif’s chain pairs that condition with the out-of-bounds write on multicast membership counters. The write modifies page table entries, which is how the exploit gets from a local user process to supervisor-level access to user memory, and it does so while defeating KARL, SMAP and SMEP without an information leak.
Timeline and Patching Status
The original code was defined in 1988. OpenBSD released errata 018 on September 14 and errata 026 on September 30. Calif published the exploit during the week of October 19, more than three weeks after the later fix.
The affected system is OpenBSD 7.9. Applying syspatch errata 018 and 026 closes the issues described. Systems that have not been patched are exposed to a local attacker with public exploit code, which means any account on such a machine can serve as a starting point for obtaining root.
Calif’s publication of a full exploit and write-up goes further than a vulnerability notice. A working chain lets other researchers and attackers reproduce the result against unpatched systems. The report on the release describes the exploit as bypassing KARL address randomization and SMAP and SMEP protections without an information leak, and it identifies OpenBSD 7.9 as the affected release. The two errata that fix the chain are applied through syspatch, which OpenBSD provides on all architectures.
The age of the integer overflow is the unusual detail in the story. A defect that has existed in BSD-derived code since 1988 survived decades of review in a project known for auditing its source. The fact that the exploit works without an information leak also removes a step that attackers usually need when randomization defenses such as KARL are in place, according to Calif’s description. For administrators, the practical effect is limited to unpatched hosts, since both patches have been available since September.
