openbsd
Latest stories covering openbsd, with summaries and links to related coverage.
2 articles · page 1 of 1
Connected topics
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
research
6 min read
Calif disclosed an OpenBSD local privilege-escalation exploit that combines two kernel flaws to obtain a root shell despite KARL, SMAP and SMEP protections. One flaw originates in original BSD code from roughly 37 years ago: a System V shared-memory attachment counter was stored as a signed 16-bit value. Repeated process forks could overflow the counter past 32,767 and wrap it to a negative value, enabling a race condition that produced a use-after-free. The exploit paired that bug with a separate kernel out-of-bounds write. It mapped 127 shared-memory segments, forked 259 processes to wrap the attachment count to -32,643, then used heap grooming and an IPC_RMID race to create a size-confused shared-memory segment. A conditional -1 write modified IP multicast-membership fields, and subsequent socket cleanup altered page-table mappings so user memory became supervisor-accessible. Calif then overwrote a predictable kernel function pointer to execute kernel code and restored it after obtaining root access. OpenBSD addressed the flaws in errata 026 and 018. Calif said OpenBSD's kernel address randomization does not randomize allocator base addresses or allocation order, leaving some early-boot kernel objects predictable on the same hardware. It proposed safe-unlinking checks, randomizing the self-referential page-table mapping, and making kernel allocation less deterministic. Calif also cited compiler-based array-bounds sanitization and forthcoming Alloc Tokens as mitigations for out-of-bounds and heap-exploitation techniques.
Vibe-Coded Ext4 for OpenBSD
tool
23 min read
Thomas de Grivel posted an ext4 implementation for OpenBSD on March 17, offering full read and write access while passing the e2fsck filesystem checker, though it lacks journaling support. The implementation includes copyright assertions but does not detail its development process.