Researchers at security firm Calif have demonstrated a local privilege escalation exploit that achieves root access on OpenBSD 7.9 by chaining two separate vulnerabilities. The exploit combines an integer overflow bug dating back approximately 37 years with a kernel flaw to bypass multiple security protections.
The attack successfully circumvents OpenBSD's KARL kernel-address randomization defense, along with SMAP and SMEP hardware protections. SMAP prevents kernel code from accessing user-space memory, while SMEP prevents kernel execution of user-space code. These are fundamental mitigations against privilege escalation attacks.
Calif published a detailed technical writeup and full proof-of-concept code after OpenBSD released patches. The researchers first identified both underlying vulnerabilities and reported them to the OpenBSD project prior to public disclosure. The decision to release technical details and working exploit code came only after the vendor deployed fixes.
The exploit targets local attackers with execution capability on affected systems. Chaining the ancient integer overflow with a more recent kernel issue demonstrates how older bugs can remain exploitable when combined with newer flaws. The age of the initial vulnerability highlights the persistence of certain classes of defects in security-critical codebases.
OpenBSD positions itself as a security-focused operating system with strict development practices and comprehensive security features. The demonstration that multiple protections can be bypassed through exploit chaining suggests defenders must consider how seemingly independent vulnerabilities can work together.
The full technical details now available in Calif's writeup provide insight into the attack mechanics and exploitation techniques used. System administrators running OpenBSD 7.9 should ensure they have applied patches addressing both the integer overflow and kernel flaw to prevent successful exploitation of this attack chain.