offensive-security
Latest stories covering offensive-security, with summaries and links to related coverage.
2 articles · page 1 of 1
Connected topics
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
research
6 min read
Calif disclosed an OpenBSD local privilege-escalation exploit that combines two kernel flaws to obtain a root shell despite KARL, SMAP and SMEP protections. One flaw originates in original BSD code from roughly 37 years ago: a System V shared-memory attachment counter was stored as a signed 16-bit value. Repeated process forks could overflow the counter past 32,767 and wrap it to a negative value, enabling a race condition that produced a use-after-free. The exploit paired that bug with a separate kernel out-of-bounds write. It mapped 127 shared-memory segments, forked 259 processes to wrap the attachment count to -32,643, then used heap grooming and an IPC_RMID race to create a size-confused shared-memory segment. A conditional -1 write modified IP multicast-membership fields, and subsequent socket cleanup altered page-table mappings so user memory became supervisor-accessible. Calif then overwrote a predictable kernel function pointer to execute kernel code and restored it after obtaining root access. OpenBSD addressed the flaws in errata 026 and 018. Calif said OpenBSD's kernel address randomization does not randomize allocator base addresses or allocation order, leaving some early-boot kernel objects predictable on the same hardware. It proposed safe-unlinking checks, randomizing the self-referential page-table mapping, and making kernel allocation less deterministic. Calif also cited compiler-based array-bounds sanitization and forthcoming Alloc Tokens as mitigations for out-of-bounds and heap-exploitation techniques.
GPT-5.5: Mythos-Like Hacking, Open to All
tool
6 min read
OpenAI's GPT-5.5 is being released freely, offering offensive security capabilities comparable to Anthropic's Mythos, which has limited access. Testing has been conducted across various benchmarks and workflows to evaluate its performance.