Security firm **Calif** has published a detailed analysis and proof-of-concept for a critical local privilege escalation exploit affecting **OpenBSD 7.9**. The exploit leverages two distinct vulnerabilities to achieve root privileges, demonstrating a deep understanding of the operating system's internals. ### The Vulnerability Chain The exploit's entry point is an integer overflow within the `shmat(4)` attach function, a flaw that has existed in the **BSD** codebase since at least 1988. This vulnerability, classified as a reliability fix, was addressed in **OpenBSD** errata 018 on September 14. The second critical component is a reference-counting use-after-free bug, which completes the privilege escalation chain. This issue was patched separately as a security fix in errata 026 on September 30. Both fixes are available for all architectures via `syspatch`, with **OpenBSD 7.8** also receiving the integer-overflow patch. ### Bypassing OpenBSD's Protections The integer overflow occurs because the `shm_nattch` shared-memory attachment counter, defined as a signed 16-bit `short`, can be forced to wrap from its maximum value (32,767) to a negative number. By mapping 127 shared-memory segments and forking 259 processes, the counter overflows, leading to a race condition that triggers a use-after-free. This corrupted reference count causes the kernel to free memory still in use by other processes. A subsequent out-of-bounds write then targets multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries, effectively switching a user-memory mapping to supervisor-accessible. This crucial step bypasses **SMAP** (Supervisor Mode Access Prevention) and **SMEP** (Supervisor Mode Execution Prevention), hardware protections designed to prevent kernel access to userland memory. The exploit then overwrites a function pointer at a predictable kernel address to execute arbitrary code. ### Deterministic Kernel Allocators One of the key insights from **Calif** researcher **Andrew Griffiths** is that despite **OpenBSD**'s **KARL** (Kernel Address Randomized Link) relinking the kernel binary to randomize function and data addresses, the kernel's memory allocators remain deterministic. This means that early-boot structures, including function pointers in network interface handlers like `lo0` and `enc0`, consistently land at the same addresses across reboots on identical hardware. This predictability eliminates the need for an information-disclosure vulnerability within the exploit chain. ### Proposed Hardening Measures Beyond the immediate errata, **Calif** proposes several categories of hardening to further enhance **OpenBSD**'s security posture: * **Safe-unlinking for kernel linked lists:** A technique already adopted by **FreeBSD** and **NetBSD**. * **Randomization of the page-table self-referential mapping.** * **Kernel-allocator randomization.** * **Compiler-based bounds checking.** **Calif** reported the flaws to **OpenBSD** earlier this year. The full proof-of-concept exploit code is publicly available on **GitHub**.