A neighborhood privilege escalation exploit revealed at the moment good points root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD’s KARL kernel-address randomization and its SMAP and SMEP {hardware} protections. Safety agency Calif, which discovered and reported the failings, revealed a detailed writeup and full proof-of-concept code after OpenBSD shipped patches for each points in September.
The integer overflow within the shmat(4) connect operate was mounted in errata 018, shipped September 14 as a reliability repair. The reference-counting use-after-free that completes the chain was mounted individually in errata 026, shipped September 30 as a safety repair.
Each can be found by way of syspatch and canopy all architectures. OpenBSD 7.8 additionally obtained the integer-overflow repair.
The integer overflow, the entry level for the total chain, is assessed as a reliability repair, not a safety repair.
No CVE has been assigned for both flaw as of publication. There isn’t any proof that the vulnerabilities have been utilized in assaults.
The shared-memory attachment counter shm_nattch is outlined as a signed 16-bit brief with a most worth of 32,767 in authentic BSD sources courting to 1988. OpenBSD inherited the sort and by no means widened it.
The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter previous its most and wrapping it to −32,643. A race situation then triggers a use-after-free: the corrupted reference rely causes the kernel to free reminiscence that different processes nonetheless use.
A separate out-of-bounds write overwrites multicast-membership counters within the kernel. When the affected socket closes, the ensuing decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible and bypassing SMAP and SMEP. The exploit then overwrites a operate pointer at a predictable kernel deal with to run its personal code.
“Whereas OpenBSD’s KARL relinks the kernel binary to randomize each operate and knowledge addresses, the kernel’s reminiscence allocators stay deterministic,” researcher Andrew Griffiths wrote. Each the boot-time and best-fit allocators lack base-address randomization, so early-boot constructions, together with operate pointers within the lo0 and enc0 network-interface handlers, land on the identical addresses throughout reboots on the identical {hardware}. The exploit wants no information-disclosure vulnerability.
Past the 2 errata, Calif proposes 4 classes of hardening: safe-unlinking for kernel linked lists (already utilized by FreeBSD and NetBSD), randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.
Calif mentioned it reported the failings to OpenBSD “earlier this yr.” The proof-of-concept exploit code is on the market on GitHub.
