BIG FISH: EXPLOITING A 37-YEAR-OLD KERNEL BUG IN OPENBSD

Summary from the TLDR InfoSec newsletter

Calif reported two OpenBSD vulnerabilities that enabled local privilege escalation to root. A signed 16-bit shared-memory attachment counter, dating to the original BSD sources, could overflow after repeated forking and wrap to a negative value. That enabled a use-after-free race condition. A separate out-of-bounds write gave the exploit a write-what-where primitive. The exploit worked with KARL, SMAP, and SMEP enabled, using heap grooming, SysV shared-memory manipulation, IP multicast socket allocations, and PTE self-referential mapping changes to reach kernel execution.