Vulnerabilities
Researchers Show How to Gain Root on OpenBSD Using 37-Year-Old Bug
Security researchers have shown how to gain full control of OpenBSD by chaining a decades-old shared-memory bug with a new kernel flaw. Patches are available, but no attacks have been seen in the wild.
Ross Grant3 min read
The short version
Researchers have shown how to take over OpenBSD computers by combining two bugs, one of which dates back nearly four decades. The flaws let someone with access to the computer gain full control, even bypassing advanced security features. OpenBSD has released patches, and there is no sign anyone has used these bugs for attacks yet. Users should update their systems to stay safe.
What happened?
Researchers from Calif have published a proof-of-concept exploit that chains two vulnerabilities to gain root access on OpenBSD 7.9. The flaws include a 37-year-old integer overflow in shared memory and a use-after-free bug in the kernel. OpenBSD released patches for both issues in September 2026. There is no evidence of attacks using these vulnerabilities.
What researchers found
Security researchers at Calif have demonstrated a way to gain root access (full control) on OpenBSD 7.9 by chaining two vulnerabilities. The first is an integer overflow bug in the shared-memory system, dating back to 1988 in BSD code. The second is a use-after-free bug in the kernel. By combining these, the exploit bypasses several of OpenBSD's key defences, including kernel address randomisation (KARL), SMAP (Supervisor Mode Access Prevention), and SMEP (Supervisor Mode Execution Prevention) protections.
The researchers published a detailed writeup and proof-of-concept code after OpenBSD released patches for both issues in September 2026. According to The Hacker News (opens in a new tab), there is no evidence that these vulnerabilities have been used in real-world attacks.
How the exploit works
The exploit starts with the integer overflow in the shmat(4) attach function. This bug is in the shared-memory attachment counter (shm_nattch), which is a signed 16-bit value with a maximum of 32,767. By mapping 127 shared-memory segments and forking 259 processes, the exploit pushes the counter past its maximum, causing it to wrap around to a negative number. This sets up a race condition that triggers a use-after-free bug: the kernel frees memory that is still in use by other processes.
The next step is to use an out-of-bounds write to overwrite multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries. This switches a user-memory mapping to supervisor-accessible, bypassing SMAP and SMEP. The attacker can then overwrite a function pointer at a predictable address in the kernel and run their own code as root.
OpenBSD's defences and why they failed
OpenBSD is known for its security features, including KARL, SMAP, and SMEP. KARL randomises kernel addresses at boot time, making it harder for attackers to predict where code and data are in memory. However, the researchers found that OpenBSD's memory allocators are deterministic: they always put certain structures in the same place on the same hardware. This means the exploit does not need to leak any addresses to succeed.
The researchers suggest that OpenBSD could improve its defences by adopting safe-unlinking for kernel linked lists (already used in FreeBSD and NetBSD), randomising the page-table mapping, randomising kernel memory allocation, and using compiler-based bounds checking.
What OpenBSD has done
OpenBSD fixed the integer overflow as a reliability issue in errata 018 (released 14 September 2026) and the use-after-free as a security issue in errata 026 (released 30 September 2026). Both patches are available through syspatch and cover all architectures. OpenBSD 7.8 also received the integer-overflow fix. As of now, neither flaw has a CVE identifier.
What users should do
Anyone running OpenBSD 7.9 or 7.8 should apply the latest patches as soon as possible. The exploit requires local access, so it cannot be used remotely, but it could be valuable to someone who already has a foothold on a system. There is no evidence of exploitation in the wild, but unpatched systems remain at risk if attackers gain local access.
What could happen next
The researchers have published proof-of-concept code, which means attackers could try to adapt it for real attacks. OpenBSD users should stay alert for further updates and consider the hardening suggestions made by the researchers. Other BSD-based systems may want to review their own shared-memory code for similar legacy issues.
Claimed vs confirmed
- Confirmed
Researchers can gain root on OpenBSD 7.9 by chaining two bugs.
The Hacker News reports that Calif researchers published a working exploit after patches were released.
- Confirmed
The integer overflow bug dates back 37 years to 1988 BSD code.
The Hacker News attributes this to the original BSD sources and OpenBSD's inheritance of the code.
- Confirmed
No evidence of exploitation in the wild.
The Hacker News states there is no sign these vulnerabilities have been used in attacks.
The impact
- Money
- No direct financial impact is reported. However, under GDPR or similar laws, unpatched systems that lead to breaches could face fines up to £17.5m or 4% of global turnover, whichever is higher.
- Reputation
- OpenBSD's reputation for security could be affected, especially since one bug dates back decades and bypasses key defences. The public release of exploit code may increase scrutiny.
- Customers
- Anyone running OpenBSD 7.9 or 7.8 should apply patches immediately. The exploit requires local access, so remote users are not directly at risk, but systems with multiple users or exposed terminals are more vulnerable.
Why it matters
OpenBSD is widely used for security-critical systems. These vulnerabilities could let an attacker with local access take full control, despite OpenBSD's reputation for strong security. Patches are available, but unpatched systems remain at risk.
How does it work?
The exploit uses an integer overflow in the shared-memory attachment counter to trigger a use-after-free bug in the kernel. This allows an attacker to overwrite kernel memory and run code as root, bypassing several security features. The attack requires local access to the system.
Key points
- Researchers chained two bugs to gain root on OpenBSD 7.9.
- One flaw dates back to 1988 and affects shared memory.
- The exploit bypasses OpenBSD's key security features.
- Patches are available and should be applied immediately.
- No attacks using these flaws have been reported.
Sources
The Hacker News
Reference
