New Exploit Chains Decades‑Old Bug to Gain Root on OpenBSD 7.9

A security researcher disclosed a local privilege‑escalation exploit today that grants full root access on the latest OpenBSD 7.9 release by linking a 37‑year‑old integer overflow with a separate, previously unexploited kernel flaw.

The attack begins with an overflow in the kernel's shared‑memory handling code that dates back to the early 1990s, when the operating system was first being ported to the Intel architecture. By carefully crafting memory allocations, the exploit corrupts a pointer used by the kernel's memory manager, setting the stage for a second vulnerability that allows arbitrary code execution in kernel space.

Once the corrupted pointer is in place, the second flaw—an out‑of‑bounds write in a different subsystem—lets the attacker overwrite critical control data. The combined effect defeats OpenBSD's KARL (Kernel Address Randomization Layer) randomization, as well as the hardware‑enforced SMAP (Supervisor Mode Access Prevention) and SMEP (Supervisor Mode Execution Prevention) defenses that normally block user‑space code from executing in privileged contexts.

OpenBSD has long marketed itself as a security‑focused operating system, routinely disabling unnecessary services and hardening the kernel against known attack vectors. The KARL mechanism, introduced in recent releases, was intended to make address‑space layout randomization more robust than traditional ASLR. The new exploit demonstrates that even layered mitigations can be bypassed when multiple independent bugs are chained together.

Security firm Calif, which first reported the findings, released a detailed advisory and provided proof‑of‑concept code to the OpenBSD developers. The advisory notes that the integer overflow has been present in the codebase for nearly four decades, but its exploitation required the newly discovered kernel write primitive, highlighting how legacy code can become a liability when combined with fresh vulnerabilities.

OpenBSD maintainers responded quickly, confirming that patches for both flaws will be included in the forthcoming 7.10 point release. In the meantime, administrators are advised to apply any interim mitigations offered by the project, such as disabling the affected shared‑memory interfaces where feasible, and to monitor for any signs of unauthorized activity on systems running the vulnerable version.

The incident underscores a broader trend in software security: attackers increasingly look for ways to compound older, unpatched bugs with newer weaknesses to subvert modern defenses. It also serves as a reminder that even operating systems with a reputation for rigorous code auditing are not immune to complex exploit chains that leverage the depth of their legacy code.