安全研究团队Calif近日发现并成功利用了OpenBSD内核中一个存在37年之久的漏洞1。该漏洞源自原始BSD代码，由于共享内存附加计数器被定义为有符号16位短整数，最大值仅为32,767，通过重复fork进程可导致计数器溢出至负值-32,6431。
研究人员通过结合该整数溢出漏洞与use-after-free和越界写漏洞，成功在启用KARL/SMAP/SMEP保护机制的OpenBSD系统上实现本地权限提升至root1。该漏洞已通过errata 026和018得到修复1。研究团队同时建议采用safe-unlinking技术、PTE映射地址随机化以及非确定性内核分配器等防护方案，以进一步加强系统安全性1。
Security research team Calif has discovered and exploited a vulnerability in the OpenBSD kernel that has persisted for approximately 37 years, originating from the original BSD codebase.1 The flaw stems from the shared memory attachment counter being defined as a signed 16-bit short integer with a maximum value of 32,767, which can overflow into a negative value of -32,643 through repeated process forking.1 This integer overflow, when combined with a use-after-free condition and an out-of-bounds write vulnerability, enables local privilege escalation to root access.1
The vulnerability has been successfully exploited to achieve root shell access on OpenBSD systems with KARL, SMAP, and SMEP security features enabled.1 The flaw has been patched through errata 026 and 018.1 To mitigate similar issues going forward, the researchers recommend implementing safe-unlinking techniques, randomizing PTE mapping addresses, and deploying non-deterministic kernel allocators.1
评论
还没有评论，欢迎留下第一条。