Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
A research team uncovered a 37-year-old kernel bug in OpenBSD, enabling local root access through an integer overflow and race condition. The detailed exploit and proposed mitigations have sparked intense debate on OpenBSD's vaunted security posture and the enduring challenges of C language vulnerabilities.
The Lowdown
Calif's offensive research arm recently disclosed a critical local privilege escalation vulnerability in OpenBSD, tracing its origins back 37 years to the original BSD sources. The exploit leverages a long-standing integer overflow in a shared memory attachment counter, leading to a race condition and a use-after-free.
This "Big Fish" exploit demonstrates how an ancient bug can be weaponized even against hardened systems:
- A signed 16-bit
shm_nattchcounter, when repeatedly incremented by forking processes, can wrap to a negative value. - This integer overflow creates a use-after-free opportunity through a race condition.
- Combined with a separate out-of-bounds write in the kernel, this allowed for local privilege escalation to root.
- The exploit involved intricate steps like heap grooming, winning a race condition, aligning IP socket allocations, triggering a conditional -1 out-of-bounds write, and manipulating PTE self-referential mappings to achieve kernel code execution.
- The researchers also detailed potential mitigations, including safe-unlinking, randomizing self-referential PTE map allocations, non-deterministic kernel allocators, and compiler features like AddressSanitizer and Alloc Tokens.
The findings highlight the persistent challenge of deep-seated bugs in critical software and underscore the ongoing efforts required in system hardening, especially as AI-assisted tools advance vulnerability discovery.
The Gossip
OpenBSD's Security Scrutiny
Commenters vigorously debated OpenBSD's reputation as a highly secure and audited codebase. Some expressed surprise that such an old bug could persist in a system known for its rigorous security practices. Others argued that OpenBSD's claims are overblown or misunderstood, pointing out that its 'two remote holes in a long time' slogan applies only to a minimal default install, and that a small developer team limits true audit depth. The discussion also touched on the project's strategy of reducing attack surface by minimizing default services and removing features.
C's Chronic Conundrums
A significant thread revolved around the inherent unsafety of the C programming language, with many questioning whether 'correct C code' is even achievable. Some suggested that moving to memory-safe languages is the only long-term solution, while others argued for formal verification or adding memory safety features to C. There was also speculation on whether fuzzing or static analysis, especially AI-powered tools, could have detected this 37-year-old integer overflow, noting that traditional fuzzing might miss such edge cases.
Blog Post Ponderings
The quality and style of the blog post itself became a minor point of contention. While some appreciated the conciseness, others criticized the brevity of the exploit explanation, wishing for more detailed write-ups for educational purposes. There was also some speculation regarding whether the post, or at least its accompanying graphic, was AI-generated, leading to a broader discussion about AI's role in vulnerability discovery and technical communication.