Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

Researchers discovered and exploited a 37-year-old kernel bug in OpenBSD stemming from a shared memory attachment counter defined as a signed 16-bit value, which could overflow and trigger a use-after-free vulnerability combined with an out-of-bounds write, allowing local privilege escalation to root even with security protections like KARL, SMAP, and SMEP enabled. The exploit involved manipulating shared memory segments, heap grooming, winning a race condition, and leveraging socket allocations to achieve kernel code execution and obtain root access. OpenBSD addressed both vulnerabilities in errata updates 026 and 018.