A newly disclosed exploit chain for the OpenBSD kernel combines a shared memory accounting flaw with an out-of-bounds write, granting root privileges This article explores openbsd addressed vulnerabilities. . The research, titled "Big Fish," includes public proof-of-concept code despite several security protections being enabled.

The oldest flaw involves a shared-memory attachment counter inherited from BSD code dating back approximately 37 years. OpenBSD addressed the vulnerabilities through errata 026_sysvipc and 018_shmat for version 7.9. In the published exploit sequence, the researcher mapped 127 System V shared memory segments, unmapped them using munmap(), and forked 259 processes. Heap grooming followed by the exposure of allocation statistics through sysctl(KERN_MALLOCSTATS) allowed for monitoring memory placement and identifying fresh allocations.

Griffiths revealed obtaining root privileges with Kernel Address Randomization (KARL), Supervisor Mode Access Prevention, and Supervisor Mode Execution Prevention enabled, without needing an information disclosure vulnerability. Despite KARL rearranging kernel code and data, Calif observed that deterministic allocation behavior left certain early-boot structures at predictable locations on the same hardware. Beyond the fixes, Calif suggested additional hardening measures such as safe-unlinking checks, randomized page-table mappings, and less predictable kernel allocation.

These proposals aim to disrupt exploitable techniques; the report does not guarantee that every proposed defense has been implemented by OpenBSD or included in supported releases.