OpenBSD 7.9 root exploit chains 37-year-old integer overflow with UAF

Affected Systems

OpenBSD 7.9 and 7.8 (all architectures). Vulnerability in shmat(4) shared-memory attach function (integer overflow) and separate kernel reference-counting use-after-free. Both flaws patched via errata 018 (Sept 14) and 026 (Sept 30).

Exploitation Status

Proof-of-concept code publicly available on GitHub. No evidence of active exploitation in the wild. Exploit requires local access and chains two vulnerabilities to bypass KARL, SMAP, and SMEP protections.

Business Impact

Local privilege escalation to root on vulnerable OpenBSD systems. Exploit is complex (requires chaining two bugs, race condition, and deterministic kernel allocator behavior) but fully functional. No CVE assigned. Risk limited to environments where attackers have local shell access. OpenBSD patches available since September 2024 via syspatch.

Urgency

🟡 Within a week

Recommended Actions

• Apply OpenBSD errata 018 and 026 immediately via syspatch on all OpenBSD 7.8 and 7.9 systems
• Verify patch status by running 'syspatch -c' and confirm both errata are installed
• Review local user access controls and restrict shell access to trusted accounts only
• Monitor for unusual shared-memory segment creation (127+ segments) or mass process forking (250+ children) via system logs
• Prioritize patching on multi-user OpenBSD systems or those accessible to untrusted local users