Story
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
1 report
1 website
1 discussion
Latest report
Overview
Calif disclosed an OpenBSD local privilege-escalation exploit that combines two kernel flaws to obtain a root shell despite KARL, SMAP and SMEP protections. One flaw originates in original BSD code from roughly 37 years ago: a System V shared-memory attachment counter was stored as a signed 16-bit value. Repeated process forks could overflow the counter past 32,767 and wrap it to a negative value, enabling a race condition that produced a use-after-free. The exploit paired that bug with a separate kernel out-of-bounds write. It mapped 127 shared-memory segments, forked 259 processes to wrap the attachment count to -32,643, then used heap grooming and an IPC_RMID race to create a size-confused shared-memory segment. A conditional -1 write modified IP multicast-membership fields, and subsequent socket cleanup altered page-table mappings so user memory became supervisor-accessible. Calif then overwrote a predictable kernel function pointer to execute kernel code and restored it after obtaining root access. OpenBSD addressed the flaws in errata 026 and 018. Calif said OpenBSD's kernel address randomization does not randomize allocator base addresses or allocation order, leaving some early-boot kernel objects predictable on the same hardware. It proposed safe-unlinking checks, randomizing the self-referential page-table mapping, and making kernel allocation less deterministic. Calif also cited compiler-based array-bounds sanitization and forthcoming Alloc Tokens as mitigations for out-of-bounds and heap-exploitation techniques.
Summary from calif.io.
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · calif.io
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-10-17.
The AI angle was a small but revealing side thread rather than the substance of the discussion. One participant claimed the site’s exploit coverage is machine-generated and suggested AI is also discovering vulnerabilities, framing it as an automated analogue to fuzzing. Another gave a more concrete anecdote: directing an AI system at tiny, mature OpenBSD utilities reportedly surfaced several longstanding defects, including a buffer overflow that was probably difficult to weaponize. The implication was not that AI has solved vulnerability research, but that it can cheaply widen the search across old C code where manual review has plainly missed flaws for decades. There was no real evaluation of which model, workflow, or verification process produced those findings, so enthusiasm remained anecdotal. The only unambiguously negative AI reaction concerned presentation: a reader found an AI-generated lead image off-putting before the article had established any technical value. The broader thread focused on OpenBSD’s security reputation and C-language bugs, but those arguments did not materially assess AI systems. Overall, commenters treated AI-assisted bug hunting as plausible and potentially useful, while offering little evidence that generated editorial content or visuals improve the reader experience.
The narrow dispute is whether AI is becoming a meaningful vulnerability-discovery tool or merely being loosely compared to fuzzing. Supporters point to AI reportedly finding old defects in small, established Unix tools; skeptics have no direct rebuttal, but the discussion provides no reproducible evidence, model details, or proof that AI found bugs humans and conventional analysis would not.
- Praise: AI-assisted inspection reportedly uncovered several long-lived bugs in tiny OpenBSD utilities, suggesting language models can make broad legacy-code triage far cheaper.
- Praise: Treating AI as a complement to fuzzing could help researchers probe the vast stock of aging C code that has survived ordinary review for decades.
- Concern: The claim that AI generates the site’s exploit reporting and finds its bugs is asserted without methodology or validation, making it impossible to separate real research from automated content production.
- Concern: An AI-generated hero graphic repelled at least one reader immediately, showing that synthetic presentation can undermine trust before technical reporting begins.