Calif Researchers Exploit 37-Year-Old OpenBSD Kernel Bug to Gain Root
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
Calif researchers exploited a 37-year-old signed 16-bit shared memory counter overflow in OpenBSD, chaining it with an out-of-bounds write to achieve local root despite KARL, SMAP, and SMEP. They detail the exploit path and propose mitigations like safe-unlinking, PTE map randomization, and kernel allocator randomization.
Taking a step back, this vulnerability ended up getting code execution via a `write what where` primitive, where the `write` was caused by a `TAILQ_REMOVE`, the `what` was our userland memory mapping that was made supervisor mode accessible to bypass `SMAP`/`SMEP`, and the `where` was a predictable kernel pointer location.