Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

phendrenad2

Interestingly, looks like this was accidentally fixed in NetBSD during a rewrite of that code in August of 1999.

ozereray1

It’s remarkable that a bug survived 37 years in one of the most heavily audited codebases, which shows how hard some kernel bugs are to catch by review alone. Do you think fuzzing or static analysis could realistically have found this class of bug, or did it need a human thinking about the exploit primitive?

bch

Props for the OpenBSD Release -style graphics. Looking forward to the theme song.

shevy-java

Poor OpenBSD guys. Now they have to acknowledge THREE exploits (in total) on their homepage.

ewy1

the ai-generated graphic before any content is presented is kind of a turnoff

userbinator

Map 127 SysV shared memory segments, unmap them via munmap(), and fork 259 processes to wrap the shared memory attach count to -32,643. LOL. The actual exploit code at https://raw.githubusercontent.com/califio/publications/main/... contains comments, but they're extremely difficult for a human to understand. This reminds me of the process that video game speedrunners often use, and looks just like unintelligible wizardry to an outsider: https://news.ycombinator.com/item?id=24456247