A signed 16-bit counter from the original BSD code gave researchers root on hardened OpenBSD

From overflow to root shell

Calif's write-up starts with shm_nattch, the SysV shared-memory attachment counter, defined as a signed 16-bit short. Repeatedly forking processes with attachments pushes it past 32,767 and wraps it negative; a race condition then turns that into a use-after-free. Combined with a separate out-of-bounds write in the kernel, it yields local privilege escalation to root. Fixes shipped in errata 026 and 018.

The exploit maps 127 shared memory segments, unmaps them, and forks 259 processes to land the counter at -32,643. It grooms the kernel heap using malloc statistics from sysctl, wins the race by removing a segment with IPC_RMID while a helper process attaches a new one, then places a socket's ip_moptions structure where the out-of-bounds write corrupts its membership counters. Closing the socket triggers atomic decrements that alter the page-table self-reference mapping, giving the kernel access to userland memory, after which it overwrites a predictable kernel function pointer and restores it. The author calls the result a write-what-where primitive.

Why determinism is the weakness

The authors argue that OpenBSD's deterministic allocators make this reliable and suggest safe-unlinking checks, randomizing the page-table self-reference address and allocator layout, and compiler support such as array bounds sanitizers and allocation tokens.

The audit myth, and what the bug says about C

One commenter who pointed an AI at OpenBSD's two smallest tools, `cat` and `find`, found multiple bugs there too:

"Nobody in history has been able to write correct C code, and that includes OpenBSD developers… IIRC these bugs had existed since at least the NetBSD/OpenBSD split."

A correction came from a self-described perpetual student and sometimes developer, answering a joke that OpenBSD must now amend its homepage: the headline promises "only two remote holes in the default install", and "this isn't remote", so the claim stands. The exploit needs local code execution, which makes it a threat to shared and multi-user machines rather than to a default server. Apply errata 026 and 018 wherever untrusted users have shells.