Cybersecurity researchers have demonstrated a way to gain the highest privileges in the OpenBSD operating system (version 7.9). To do this, they used a combination of two bugs, one of which has existed in the code since 1988.
Cybersecurity researchers have demonstrated a way to gain the highest privileges in the OpenBSD operating system (version 7.9). To do this, they used a combination of two bugs, one of which has existed in the code since 1988.
A detailed report and example of working code were published by the Calif cybersecurity company, which previously found these problems and helped developers fix them, The Hacker News writes .
The main flaw was hidden in the outdated shared memory management system. 37 years ago, the memory access counter was designed to be too "cozy" - it could only count up to 32,767. When the OpenBSD developers inherited this code, they did not increase its limit.
The researchers found a way to "overflow" this counter. By running special processes, they tricked the system into thinking that the counter had become negative. This confused the kernel and forced it to delete important data from memory that was still being used by other programs.
The attack begins by confusing the system: a specially created hacker script artificially overflows the old memory counter, which leads to a failure in its accounting.
By creating this confusion, researchers can easily bypass modern kernel security mechanisms, including hardware memory protection at the processor level (SMAP and SMEP). The main vulnerability here turned out to be the predictability of the system: although OpenBSD is considered one of the most secure operating systems in the world and constantly randomizes the internal addresses of program code, the placement of individual elements in memory during computer boot remained exactly the same every time.
Thanks to this pattern, hackers didn't even have to read the secret addresses - they simply replaced one of the system function pointers with their own code, instantly gaining full administrator rights.
OpenBSD developers released the relevant updates (patches) back in September, so all system users simply need to update it via the standard syspatch command.
There is currently no evidence that anyone has used this vulnerability to launch actual attacks on users or servers.
The proof-of-concept exploit code is available on GitHub .
