Security researchers demonstrated a root-level privilege escalation exploit on OpenBSD 7.9 by chaining a 37-year-old integer overflow in shmat with a kernel use-after-free.
The technique bypasses KARL and SMAP/SMEP protections.
OpenBSD addressed both components in September through errata 018 and 026.
No CVEs have been assigned and no active exploitation has been observed.
How did the method work?
One problem was in a counter that had been around since the old versions of BSD, in 1988. When the counter exceeded its limit, it would get an incorrect value. Combined with a second bug in the core part of the operating system, this could cause the system to free memory that was still being used by other programs. The researchers exploited the sequence to change critical data and execute their own code with administrator privileges.
The fixes were released in September.
Calif discovered the issues and reported them to OpenBSD earlier this year. OpenBSD released two separate fixes: one on September 14 for the counter issue and one on September 30 for the second bug. The counter fix was classified as a reliability fix, not a security fix. It was also released for OpenBSD 7.8. Both fixes are available for all system types supported by OpenBSD, via its update tool.
As of publication, neither issue has been given an official reference number, and there is no indication that they have been used in actual attacks.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)