Security firm Calif has published a local privilege-escalation exploit that gains root on OpenBSD 7.9 by chaining two kernel flaws: a roughly 37-year-old integer overflow inherited from 1988 BSD source and a separate reference-counting use-after-free. The chain also bypasses OpenBSD's KARL kernel-address randomization and the SMAP and SMEP hardware protections. Calif released the full proof-of-concept code after OpenBSD shipped patches for both issues in September.
The entry point is a signed 16-bit counter, shm_nattch, used by the shared-memory attach function shmat; its maximum value is 32,767. The exploit maps 127 shared-memory segments and forks 259 processes, wrapping the counter to −32,643. A race condition then triggers a use-after-free, and a separate out-of-bounds write overwrites multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible and bypassing SMAP and SMEP. The exploit then overwrites a function pointer at a predictable kernel address to run its own code.
KARL relinks the kernel binary to randomize function and data addresses, but the kernel's memory allocators remain deterministic. As researcher Andrew Griffiths wrote, early-boot structures, including function pointers in the lo0 and enc0 network-interface handlers, land at the same addresses across reboots on the same hardware. As a result, the exploit needs no information-disclosure vulnerability. No CVE had been assigned to either flaw as of publication, and there is no evidence the vulnerabilities have been used in attacks.
OpenBSD fixed the integer overflow in errata 018, shipped September 14 as a reliability fix, and the use-after-free in errata 026, shipped September 30 as a security fix. Both are available through syspatch and cover all architectures; OpenBSD 7.8 also received the integer-overflow fix. Beyond these patches, Calif proposes additional hardening: safe-unlinking for kernel linked lists, randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.