kernel-vulnerabilities
Latest stories covering kernel-vulnerabilities, with summaries and links to related coverage.
2 articles · page 1 of 1
Connected topics
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
research
6 min read
Calif disclosed an OpenBSD local privilege-escalation exploit that combines two kernel flaws to obtain a root shell despite KARL, SMAP and SMEP protections. One flaw originates in original BSD code from roughly 37 years ago: a System V shared-memory attachment counter was stored as a signed 16-bit value. Repeated process forks could overflow the counter past 32,767 and wrap it to a negative value, enabling a race condition that produced a use-after-free. The exploit paired that bug with a separate kernel out-of-bounds write. It mapped 127 shared-memory segments, forked 259 processes to wrap the attachment count to -32,643, then used heap grooming and an IPC_RMID race to create a size-confused shared-memory segment. A conditional -1 write modified IP multicast-membership fields, and subsequent socket cleanup altered page-table mappings so user memory became supervisor-accessible. Calif then overwrote a predictable kernel function pointer to execute kernel code and restored it after obtaining root access. OpenBSD addressed the flaws in errata 026 and 018. Calif said OpenBSD's kernel address randomization does not randomize allocator base addresses or allocation order, leaving some early-boot kernel objects predictable on the same hardware. It proposed safe-unlinking checks, randomizing the self-referential page-table mapping, and making kernel allocation less deterministic. Calif also cited compiler-based array-bounds sanitization and forthcoming Alloc Tokens as mitigations for out-of-bounds and heap-exploitation techniques.
Who Writes the Bugs? A Deeper Look at 125,000 Kernel Vulnerabilities
research
17 min read
An analysis of 125,000 kernel vulnerabilities reveals that bugs remain undetected for an average of 2.1 years, with race conditions lasting over twice as long as other types. VulnBERT has been developed to identify these vulnerabilities at the commit stage.