OpenBSD Critical Flaw Allows Local Root Privilege Escalation via Use-After-Free
OpenBSD has a use-after-free allowing local privilege escalation to root
A severe use-after-free vulnerability in OpenBSD versions through 7.9 enables local attackers to escalate privileges to root. This flaw occurs in the sys_semget function during a context switch after tsleep. With a CVSS score of 7.4, this high-severity issue requires immediate attention from system administrators to patch their systems and prevent unauthorized access.
sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root.
- Tiberium
Seems to be found as a part of Patch The Planet [0] which is basically OpenAI giving model access and Trail of Bits using them to find vulnerabilities in OSS projects.
- trashb
One bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.
- Arubis
OpenBSD's security stance being the stuff of legend, I'm curious how many vulns have been found over the last couple months while the big model companies are flaunting their ability to find exploits. It'd be super cool to see it remain tiny.
- uticus
> Only two remote holes in the default install, in a heck of a long time!
- gjvc
from the link:
sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().
- tiffanyh
Can anyone find the mailing list thread on this topic (or does it not exist because @security are private mailing list)?
I did find another use-after-free bug from a couple months ago on the mailing list:
- jsiepkes
If this is a local privilege escalation to root, why can't I find anything on https://www.openbsd.org/security.html ?
- poly2it
Would Rust have made this issue impossible by construction? I know Linus has spoken about Rust's promises about memory safety not being equivalently applicable in the kernel domain, so I would be curious to hear any kernel developer's perspectives.