OpenBSD root exploit chains 37-year-old BSD bug with kernel flaw

Calif published a full local privilege escalation exploit for OpenBSD 7.9 that chains a 37-year-old integer overflow inherited from BSD sources with a use-after-free kernel flaw. The exploit bypasses KARL, SMAP and SMEP without any info leak; patches shipped September 14 and 30 via syspatch.

• shm_nattch was a signed 16-bit counter since 1988, capped at 32,767
• 127 shared memory segments and 259 forked processes wrap it into a use-after-free
• A second out-of-bounds write bypasses SMAP and SMEP protections
• Fixes in errata 018 and 026; no CVE assigned yet