Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

Researchers discovered a 37‑year‑old vulnerability in OpenBSD where the SysV shared memory attachment counter used a signed 16‑bit integer. Repeatedly forking processes after mapping and unmapping shared memory wraps that counter negative, enabling a use‑after‑free via a race and, combined with an in‑kernel out‑of‑bounds write, a local privilege escalation to root even with KARL/SMAP/SMEP enabled and without an information disclosure. The exploit maps 127 shared segments, forks 259 processes to wrap the counter, grooms the heap using malloc stats, wins a race with IPC_RMID while creating a size‑confused attachment, and manipulates IP socket allocations (setting IP_MULTICAST_TTL=2) to corrupt packed 16‑bit membership counters in struct ip_moptions. Closing the socket triggers atomic decrements that overwrite the self‑referential PTE mapping twice, flip a user mapping to supervisor, and produce a write‑what‑where to a predictable kernel pointer, enabling kernel code execution and restoration to obtain a root shell. Fixes are recorded in errata 026 and 018.

The writeup highlights why KARL’s relinking is insufficient when kernel allocators are deterministic: predictable early allocations (e.g., lo0 and enc0 ioctl handlers) become reliable targets. Recommended mitigations include safe‑unlinking checks, randomizing the recursive PTE slot at boot using .openbsd.randomdata, and making the kernel allocator non‑deterministic via base and runtime allocation randomization. Compiler mitigations such as array bounds sanitizers and Alloc Tokens are proposed to eliminate whole classes of exploitable bugs. The overall argument is that proactively hardening allocators, list operations, and compiler defenses raises attacker cost and is essential as automated vulnerability discovery improves.