Researchers at security firm Calif demonstrated a local privilege escalation exploit affecting OpenBSD 7.9 that combines a 37-year-old integer overflow vulnerability with a separate kernel flaw to gain root access. The exploit bypasses OpenBSD’s KARL kernel-address randomization and hardware protections including SMAP and SMEP. OpenBSD released patches for both vulnerabilities in September 2026 through errata updates, with the integer overflow fix classified as a reliability issue and the use-after-free vulnerability addressed as a security fix.
The integer overflow originates from a shared-memory attachment counter defined as a 16-bit value since 1988, which the exploit causes to wrap to a negative number by mapping numerous shared-memory segments and forking multiple processes. This triggers a use-after-free condition that allows an out-of-bounds write to modify kernel memory protections. The researcher noted that OpenBSD’s memory allocators remain deterministic despite kernel binary randomization, allowing predictable placement of function pointers that the exploit can target. Calif has published detailed documentation and proof-of-concept code following the availability of patches.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
