Calif Researchers Exploit 37-Year-Old OpenBSD Kernel Integer Overflow for Root Access

Security researchers at Calif published details on exploiting a decades-old kernel vulnerability in OpenBSD that allows local users to gain root privileges. The disclosure highlights how a legacy integer overflow in shared memory handling can be chained with a separate out-of-bounds write to bypass modern security controls like KARL, SMAP, and SMEP.

The exploit leverages a flaw where the shared memory attachment counter was defined as a signed 16-bit short. By repeatedly forking processes with shared memory attachments, attackers can push this counter past its maximum value of 32,767. This causes the counter to wrap to a negative value, creating an integer overflow condition that leads to a use-after-free vulnerability via a race condition.

Context and Background

According to Calif, this specific integer overflow issue was addressed in OpenBSD errata 026. The researchers noted that the root cause can be traced back roughly 37 years to the original BSD sources. The separate out-of-bounds write vulnerability required for the full escalation path was addressed in errata 018. These patches resolved the specific issues identified by the security firm earlier this year.

The exploit path described by Calif involves mapping 127 System V shared memory segments and then unmapping them. Researchers forked 259 processes to wrap the shared memory attach count to -32,643. They used heap grooming techniques, tracking allocations via sysctl metrics like kb_total and kb_totalfree, to determine when new pages were allocated. This allowed them to win the race condition by using IPC_RMID in one process while attaching a new size-confused shared memory segment in a helper process.

Who Is Affected

The vulnerability affects OpenBSD systems that had not yet applied the relevant errata patches. The researchers demonstrated the ability to achieve kernel code execution without using an information disclosure vulnerability. The exploit manipulates IP socket allocations by setting IP_MULTICAST_TTL to a non-default value of 2. This allocates a persistent 16-byte struct ip_moptions, which contains fields for the number of memberships and maximum memberships.

By triggering a conditional -1 out-of-bounds write, attackers can overwrite these membership fields. Closing the socket then traverses the group members, triggering atomic decrements that modify the PTE self-referential mapping twice. This switches the mapping from user to supervisor accessible, allowing the overwriting of a predictable kernel pointer. The final steps involve cleaning up shared memory accounting and restoring the overwritten kernel pointer to obtain a root shell.

What should you do?

Administrators should verify that their OpenBSD systems have applied errata 026 and 018 to address these specific kernel vulnerabilities. Organizations should monitor for any new disclosures regarding legacy kernel flaws, especially those involving shared memory or integer overflows. Reviewing process fork limits and shared memory usage can help detect unusual activity associated with heap grooming or race condition exploitation attempts.

What to do and how to stay safe: OpenBSD

• Verify that OpenBSD systems have installed errata 026 and 018 to patch the identified kernel flaws.
• Monitor system logs for unusual process forking patterns or shared memory allocation anomalies.
• Restrict user permissions to minimize the attack surface for local privilege escalation attempts.
• Review network socket configurations to detect unauthorized changes to multicast TTL values.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the root cause of the OpenBSD vulnerability?

The root cause is a signed 16-bit short definition for the shared memory attachment counter in the kernel, which allows integer overflow.

How old is the code containing this vulnerability?

The vulnerability traces back approximately 37 years to the original BSD sources, according to Calif.

Did the exploit require an information disclosure vulnerability?

No, the researchers achieved local root access without using an information disclosure vulnerability.