Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
-
Security researchers at Calif have published a working local privilege escalation exploit that achieves root on OpenBSD 7.9, chaining an integer overflow that dates back roughly 37 years with a separate kernel flaw. According to the firm, the exploit also bypasses KARL kernel-address randomization along with the SMAP and SMEP hardware protections.
The root cause is an old integer overflow in OpenBSD's shared-memory handling, which the researchers combined with a second kernel bug to escalate privileges. Calif published a detailed writeup and full proof-of-concept code once OpenBSD shipped fixes for the issues.
At this time, no specific advisory or CVE identifier has been provided in the reporting, so administrators should track OpenBSD's official errata and patch channels for the corresponding fixes.
Mitigation guidance:
- Update OpenBSD installations to a version containing the vendor's fixes as soon as they are available.
- Monitor OpenBSD's official security announcements and errata for patch details.
- Treat local privilege escalation risk seriously on multi-user or shared systems, where an unprivileged local user could exploit the chain.
Source: The Hacker News
Has your organization applied the OpenBSD patches, or are you still assessing exposure on shared systems?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login