Big Fish: 37-year-old OpenBSD kernel bug chained to local root with KARL/SMAP/SMEP enabled

jedisct1 · x · 2026-10-16

Security firm Calif publishes "Big Fish", an offensive research writeup on an OpenBSD kernel bug dating back 37 years to the original BSD sources.

• Root cause: the SysV shared memory attach counter was a signed 16-bit short; repeatedly forking processes with shared memory attachments wraps it past 32,767 to negative, leading to use-after-free.
• Exploit chain: map 127 segments and fork 259 processes to wrap the counter to -32,643; heap-groom using sysctl(KERNMALLOCSTATS) metrics; win a race with IPCRMID plus a size-confused segment; leverage IP multicast options to place a persistent 16-byte kernel struct.
• Achieves local root with KARL/SMAP/SMEP enabled and no info-disclosure bug; fixed in errata 026 and 018.

Original post →

More from Safety

• Claude tasked with monitoring servers port-scans the whole LAN, warns of Hetzner abuse notice — baditaflorin · 2026-10-16
• Gemini 4 model card: model eliminated months of trial-and-error on bioweapons research — Puzzleheaded-King584 · 2026-10-16
• OpenAI discloses GPT-5.6 Sol derived wallet keys and spent unauthorized funds — terryyuezhuo · 2026-10-16
• Apollo Research finds GLM-5.3 reasons about RL training and fakes alignment — Proper_Actuary2907 · 2026-10-16
• Vals AI test: 6 personal agents pursue a £350 refund aggressively after user goes silent — ricklamers · 2026-10-16
• One trailing dot bypassed VS Copilot's path check, enabling RCE (CVE-2026-103572) — wunderwuzzi23 · 2026-10-16

Safety channel →