TechCapsules

AI-summarised brief · reviewed before publication

A local privilege‑escalation exploit released today gains root on OpenBSD 7.9 by chaining a 37‑year‑old integer overflow in the shmat(4) attach function with a newer reference‑count use‑after‑free bug. The overflow, fixed in errata 018 on September 14, allows an attacker to wrap the 16‑bit shm_nattch counter by creating 127 shared‑memory segments and forking 259 processes, producing a negative count. A race condition then triggers the use‑after‑free, leading to an out‑of‑bounds write that corrupts multicast‑membership counters and, when a socket closes, alters page‑table entries to bypass SMAP and SMEP. The exploit overwrites a predictable kernel function pointer, executing arbitrary code despite OpenBSD’s KARL randomization. Both flaws were patched in September via syspatch; no CVEs have been assigned and no known attacks have used them.