7 ms·
OpenBSD has a use-after-free allowing local privilege escalation to root
- gjvc 3mo agofrom the link: sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().
- iberator 3mo agoBlasphemy
- znpy 3mo agoand yet...
- Tiberium 3mo agoSeems to be found as a part of Patch The Planet [0] which is basically OpenAI giving model access and Trail of Bits using them to find vulnerabilities in OSS projects. [0] https://openai.com/index/patch-the-planet/ https://openai.com/index/patch-the-planet/
- john_strinlai 3mo agoneat, i'm a big fan of trail of bits but apparently missed this announcement. here's their post: https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/ https://blog.trailofbits.com/2026/06/22/introducing-patch-th... and a summary of week 1: https://gist.github.com/patch-the-planet/69fd1aa925c8e73edea9e6e967043cbb https://gist.github.com/patch-the-planet/69fd1aa925c8e73edea...
- TacticalCoder 3mo agoSidenote but... I read this on that link: dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in 2.92rel2: CVE-2026-4890 (opens in a new window), CVE-2026-4891 (opens in a new window), CVE-2026-4892 (opens in a new window), and CVE-2026-517 dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines.
- 1vuio0pswjnm7 3mo ago"dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines." Would be nice if OpenWRT would stop including it by default
- CursedSilicon 3mo agoWhat else is out there that fits openWRT's use case? BIND seems like it would be a bit "heavy"
- toast0 3mo agoFor caching recursive dns, unbound? I got the feeling that dnsmasq does more than just recursive dns though?
- dfc 3mo agoI think that is the "challenge" with dnsmasq. In addition to caching DNS it also does, dhcp, authoritative DNS, BOOTP and TFTP.
- somat 3mo agoUnbound can do authoritative dns. It is a bit clunky so usually what you do is have NSD for the authoritative parts and unbound for the recursive parts. but unbound has local-zone: stub-zone: forward-zone: auth-zone: directives. I am not the most sophisticated dns admin but I am fairly sure that just unbound by itself can do almost any dns party trick you care to throw at it.
- Someone 3mo ago> Unbound can do authoritative dns I don’t know whether they’re right, but https://www.openbsdhandbook.com/bind/ https://www.openbsdhandbook.com/bind/ and https://www.openbsdhandbook.com/unbound/ https://www.openbsdhandbook.com/unbound/ disagree with that, saying you need the sublingual nsd for that.
- uticus 3mo ago> Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ https://www.openbsd.org/ https://en.wikipedia.org/wiki/OpenBSD#Security_record https://en.wikipedia.org/wiki/OpenBSD#Security_record
- anonym29 3mo agoLPE (to root) is serious, but it's not a remote hole.
- ptx 3mo agoIs this functionality accessible from sandboxed processes? That would make a remote hole much more dangerous when one is found, anyway. The CVE seems to concern SysV semaphores and the pledge(2) man page doesn't seem to mention those.
- brynet 3mo agoNo. https://github.com/openbsd/src/blob/d5b0ed23b6fe61f0278c37a42144770d19494ee7/sys/kern/kern_pledge.c#L91 https://github.com/openbsd/src/blob/d5b0ed23b6fe61f0278c37a4... Perhaps relevant, Students from the University of Southern Denmark released a paper earlier this month, which once again noted the fact that over ~90% of the OpenBSD base system uses pledge(2). Almost certainly all of the network speaking daemons in base do. https://arxiv.org/abs/2607.03056 https://arxiv.org/abs/2607.03056
- preetham_rangu 3mo ago[dead]
- Arubis 3mo agoOpenBSD's security stance being the stuff of legend, I'm curious how many vulns have been found over the last couple months while the big model companies are flaunting their ability to find exploits. It'd be super cool to see it remain tiny.
- ectospheno 3mo agoThe commit logs over the last few months have highlighted when an issue was found by a program. They usually name the submitter and the tool.
- wahern 3mo agoAccording to https://openai.com/index/patch-the-planet/ https://openai.com/index/patch-the-planet/ Linux: 24 LPEs, plus many additional vulnerabilities. OpenBSD: 1 LPE. FreeBSD: 7 LPEs, plus many additional vulnerabilities. Not sure what that says, though. Perhaps the models are more likely to find Linux issues because of the training.
- jsiepkes 3mo agoIf this is a local privilege escalation to root, why can't I find anything on https://www.openbsd.org/security.html https://www.openbsd.org/security.html ?
- justthehuman 3mo agoBest guess, from the commit message alone[0]: It was fixed as a bug, at the time they didn't have evidence it could lead to LPE The AI security tool then, retroactively discovered that it could have been used for LPE. Again, just my guess I could be wrong. [0] https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d https://github.com/openbsd/src/commit/1957873d2063db11dab780...
- stackghost 3mo agoOpenBSD has a reputation for being... selective about what they admit is a security-relevant bug.
- seethishat 3mo agoThey appreciate technical correctness and they do not exaggerate. Most 'security researchers' are not technically correct and they exaggerate a lot (seeking fame and all). Dismissing their claims is not being selective, it's just the right thing to do.
- deleted 3mo ago[deleted]
- tredre3 3mo agoThe fact that most security researches tend to bullshit to pump up their numbers doesn't mean that OpenBSD isn't selective. The main claim from OpenBSD is "Only two remote holes in the default install since forever". It is technically true. But it's also selective because they deliberately disable every service by default and don't install any software beyond core. Once the OS is configured to be useful, we're far from the default install and they would (and have!) refuse to update their motto when confronted with RCEs in those parts. Which is fair enough! You gotta draw the line somewhere. But that's still being very selective.
- poly2it 3mo agoWould Rust have made this issue impossible by construction? I know Linus has spoken about Rust's promises about memory safety not being equivalently applicable in the kernel domain, so I would be curious to hear any kernel developer's perspectives.
- rwaksmunski 3mo agoThe Rust ownership model prevents use after free. This type of a bug would not compile.
- _flux 3mo agoYou might not be able to express the ownership in the way that can be checked statically, so quite possibly this would then be downgraded to a runtime error (that could be handled with a panic)—but not undefined behavior.
- anoneng 3mo agoNot necessarily. Rust safety relies on OS primitives and the error here is in an OS primitive itself (kernel semaphores). Yes Rust is one language that can be widely deployed in systems programming and potentially avoid classes of memory and ownership errors. No it doesn’t magically solve all the problems. Saying “Rust would fix this” in a hypothetical situation where Rust existed in 1995 or OpenBSD was rewritten from scratch, ok, well maybe. As of today only research kernels and a very small fraction of Linux systems have been written in Rust when we are talking about kernels. People without systems and embedded programming experience need to sit down.
- dezgeg 3mo agoI don't think this is about core kernel semaphores but rather the SysV semaphore system calls?
- klodolph 3mo agoRust is designed to make this type of issue impossible, but that assumes that you can correctly encode object lifetimes in the kernel in a way that allows the compiler to check them. So I would say that any easy answer like “this would not compile” would just be a guess, because you would want to know more of the particulars in order to answer this question. I know that this is kind of a non-answer, but if you want to write a kernel in Rust you have to figure out boundaries for where unsafe {} are. In a kernel, there are probably large chunks of unsafe {} and the Rust compiler prevents certain bugs outside unsafe {} assuming there aren’t bugs inside unsafe {} that would prevent the type checker from doing its job correctly.
- bitwize 3mo ago[flagged]
- applfanboysbgon 3mo agoThe OpenBSD project was started in 1995, with ancestry going back further than that. Should they have first invented Rust? Or at what point do you suppose the decades-old codebase should have been completely rewritten?
- JCattheATM 3mo agoIt's not too late to start now, similar to how Linux did a few years back.
- tosti 3mo agoRumours of Linux being rewritten in Rust are greatly exaggerated.
- JCattheATM 3mo agoNo one is claiming that, they are at least setting a foundation for that to be possible though.
- anoneng 3mo agoTell us you know nothing about kernel programming and trust stacks while you are at it.
- convolvatron 3mo agoI know a lot about kernel programming. and the last thing as I would ever suggest as being core to kernel programming is that is a specialized discipline that uses different rules and shouldn't be accessible to neophytes. its just code. sometimes the restrictions are unfamiliar, but there is nothing magic going on here.
- tiffanyh 3mo agoCan anyone find the mailing list thread on this topic (or does it not exist because @security are private mailing list)? I did find another use-after-free bug from a couple months ago on the mailing list: https://marc.info/?t=177581065500002&r=1&w=2 https://marc.info/?t=177581065500002&r=1&w=2
- IveSeenItAll 3mo agoOh, hey, a local-user-to-root exploit on OpenBSD. Cool! Those are rare, but not unheard of, unless you're talking about Windows or Linux, where you don't hear much about this bug class, just since it's common-as-rainfall. Anyway... Does this mean OpenBSD is suddenly less interesting? Nope, it's still pretty much the best-understandable general-purpose OS, ready for your RiiR fork. So, still go for that! Burn a universe or two worth of tokens! For the planet! Does this mean OpenBSD is suddenly less secure? Nah... Its practical security level was never that much higher than that of its nominal competitors, despite Theo's best attempts, the best of which were replicated elsewhere and majority of it went ignored. The first class counts as "innovations", the rest as "experiments" which, no matter what anyone thinks, is not the same as "failed innovations." But I digress. Now, go and donate to OpenSSH (because I bet you typed ssh today, didn't you, you rascal?), publish your OxidizedBSD fork, or whatever. Just don't link to that "is OpenBSD secure?" site, because, well, gauche, dude(tte)!
- sgt 3mo agoNow I've seen it all.
- IveSeenItAll 3mo agoI've pondered it for an entire day, and I still have no idea what that means...
- rs_rs_rs_rs_rs 3mo agoI think it's important to point out that OpenBSD is not more secure than others, it's just that it's not widely adopted so no one really does audit it.
- mikem170 3mo ago> no one really does audit it Isn't this article about an AI that just audited it? > not more secure than others Didnt the audit only found one bug, much less than other kernels from the same audit?
- trashb 3mo agoOne bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.
- sunshine-o 3mo agoExactly, the entire AI industry has been trying to create an AI powered security arm race. I am not necessarily blaming them. Hard to know how much has been thrown into this but I would bet a lot. So far I have been very surprised we haven't been flooded by those type of announcements. If you look you will always find something and OpenBSD is the top price.
- cratermoon 3mo agoThey are throwing tokens at codebases and finding mostly vulnerabilities in cases that have not been worth the limited time and effort of the chronically underfunded and understaffed professional groups. There’d be a lot more value in the companies giving the money they spend on their synthetic text extruders to the organizations doing quality security research work.
- anuramat 3mo ago> they are ... finding ... vulnerabilities ... that have not been worth the time and effort ... that's kinda the entire point
- dTal 3mo agoThe point of the comment you are replying to is that it's also not worth the time and effort to use LLMs to find vulnerabilities, if "time and effort" can be measured with "money". If you factor in all the money spent on training, GPU data centers etc, it's not actually a financially efficient way to find bugs unless you profit from creating demand for LLMs. LLMs aren't cheaper than humans per unit work, yet. They're just massively deficit funded because capital thinks "AI" is going to reshape the world order, and wants in.
- quotemstr 3mo ago[dead]
- WhereIsTheTruth 3mo agoAh, it was too good to be true, BSD too is becoming rusty.. ahh, what's left?
- sys_64738 3mo agoAnybody know why the compiler didn't pick this up?
- beeeliveee 3mo agowhere poc? no poc = hyped false marketing from openai, lying about it is lpe. same with claude bug 27y.