37-Year-Old OpenBSD Kernel Bug Yields Root Shell
Original: Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
Why This Matters
Shows KARL's kernel relinking doesn't protect against deterministic allocator layouts.
Security firm Calif exploited an integer overflow in OpenBSD's shared memory code tracing back ~37 years to original BSD sources, achieving local root via use-after-free and out-of-bounds write, bypassing KARL/SMAP/SMEP without an info-leak.
A signed 16-bit short integer used as a shared memory attachment counter — introduced in the original BSD sources roughly 37 years ago — sat quietly in OpenBSD until Calif researchers found it could be wrapped past its 32,767 maximum. The path to root was methodical: map 127 SysV shared memory segments, unmap them, then fork 259 processes to push the counter to -32,643. From there, a race condition via IPC_RMID combined with a separate out-of-bounds write gave the team their write-what-where primitive.
The exploit chain is notable for what it didn't need. No information disclosure vulnerability was required despite KARL, SMAP, and SMEP all being active. Instead, Calif leveraged the determinism of OpenBSD's kernel memory allocators — both the boot-time and best-fit allocators lack base address randomization — meaning early boot allocations land at predictable locations. The team targeted lo0 and enc0 ioctl handlers reliably across reboots on the same hardware.
The actual code execution came from overwriting a PTE self-referential mapping twice via atomic decrements triggered by closing a carefully groomed IP socket, flipping the mapping from user- to supervisor-accessible. OpenBSD addressed the issues in errata 026 and 018. Calif also flagged that allocator base address randomization would cut off this class of attack for future exploits.