7 ms·
OpenBSD has a use-after-free allowing local privilege escalation to root
- iberator 2mo agoBlasphemy
- znpy 2mo agoand yet...
- gjvc 2mo agofrom the link: sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().
- Tiberium 2mo agoSeems to be found as a part of Patch The Planet [0] which is basically OpenAI giving model access and Trail of Bits using them to find vulnerabilities in OSS projects. [0] https://openai.com/index/patch-the-planet/ https://openai.com/index/patch-the-planet/
- john_strinlai 2mo agoneat, i'm a big fan of trail of bits but apparently missed this announcement. here's their post: https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/ https://blog.trailofbits.com/2026/06/22/introducing-patch-th... and a summary of week 1: https://gist.github.com/patch-the-planet/69fd1aa925c8e73edea9e6e967043cbb https://gist.github.com/patch-the-planet/69fd1aa925c8e73edea...
- TacticalCoder 2mo agoSidenote but... I read this on that link: dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in 2.92rel2: CVE-2026-4890 (opens in a new window), CVE-2026-4891 (opens in a new window), CVE-2026-4892 (opens in a new window), and CVE-2026-517 dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines.
- 1vuio0pswjnm7 2mo ago"dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines." Would be nice if OpenWRT would stop including it by default
- CursedSilicon 2mo agoWhat else is out there that fits openWRT's use case? BIND seems like it would be a bit "heavy"
- toast0 2mo agoFor caching recursive dns, unbound? I got the feeling that dnsmasq does more than just recursive dns though?
- dfc 2mo agoI think that is the "challenge" with dnsmasq. In addition to caching DNS it also does, dhcp, authoritative DNS, BOOTP and TFTP.
- somat 2mo agoUnbound can do authoritative dns. It is a bit clunky so usually what you do is have NSD for the authoritative parts and unbound for the recursive parts. but unbound has local-zone: stub-zone: forward-zone: auth-zone: directives. I am not the most sophisticated dns admin but I am fairly sure that just unbound by itself can do almost any dns party trick you care to throw at it.
- Someone 2mo ago> Unbound can do authoritative dns I don’t know whether they’re right, but https://www.openbsdhandbook.com/bind/ https://www.openbsdhandbook.com/bind/ and https://www.openbsdhandbook.com/unbound/ https://www.openbsdhandbook.com/unbound/ disagree with that, saying you need the sublingual nsd for that.
- uticus 2mo ago> Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ https://www.openbsd.org/ https://en.wikipedia.org/wiki/OpenBSD#Security_record https://en.wikipedia.org/wiki/OpenBSD#Security_record
- anonym29 2mo agoLPE (to root) is serious, but it's not a remote hole.
- ptx 2mo agoIs this functionality accessible from sandboxed processes? That would make a remote hole much more dangerous when one is found, anyway. The CVE seems to concern SysV semaphores and the pledge(2) man page doesn't seem to mention those.
- brynet 2mo agoNo. https://github.com/openbsd/src/blob/d5b0ed23b6fe61f0278c37a42144770d19494ee7/sys/kern/kern_pledge.c#L91 https://github.com/openbsd/src/blob/d5b0ed23b6fe61f0278c37a4... Perhaps relevant, Students from the University of Southern Denmark released a paper earlier this month, which once again noted the fact that over ~90% of the OpenBSD base system uses pledge(2). Almost certainly all of the network speaking daemons in base do. https://arxiv.org/abs/2607.03056 https://arxiv.org/abs/2607.03056
- preetham_rangu 2mo ago[dead]
- Arubis 2mo agoOpenBSD's security stance being the stuff of legend, I'm curious how many vulns have been found over the last couple months while the big model companies are flaunting their ability to find exploits. It'd be super cool to see it remain tiny.
- ectospheno 2mo agoThe commit logs over the last few months have highlighted when an issue was found by a program. They usually name the submitter and the tool.
- wahern 2mo agoAccording to https://openai.com/index/patch-the-planet/ https://openai.com/index/patch-the-planet/ Linux: 24 LPEs, plus many additional vulnerabilities. OpenBSD: 1 LPE. FreeBSD: 7 LPEs, plus many additional vulnerabilities. Not sure what that says, though. Perhaps the models are more likely to find Linux issues because of the training.
- jsiepkes 2mo agoIf this is a local privilege escalation to root, why can't I find anything on https://www.openbsd.org/security.html https://www.openbsd.org/security.html ?
- justthehuman 2mo agoBest guess, from the commit message alone[0]: It was fixed as a bug, at the time they didn't have evidence it could lead to LPE The AI security tool then, retroactively discovered that it could have been used for LPE. Again, just my guess I could be wrong. [0] https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d https://github.com/openbsd/src/commit/1957873d2063db11dab780...
- stackghost 2mo agoOpenBSD has a reputation for being... selective about what they admit is a security-relevant bug.
- seethishat 2mo agoThey appreciate technical correctness and they do not exaggerate. Most 'security researchers' are not technically correct and they exaggerate a lot (seeking fame and all). Dismissing their claims is not being selective, it's just the right thing to do.
- deleted 2mo ago[deleted]
- tredre3 2mo agoThe fact that most security researches tend to bullshit to pump up their numbers doesn't mean that OpenBSD isn't selective. The main claim from OpenBSD is "Only two remote holes in the default install since forever". It is technically true. But it's also selective because they deliberately disable every service by default and don't install any software beyond core. Once the OS is configured to be useful, we're far from the default install and they would (and have!) refuse to update their motto when confronted with RCEs in those parts. Which is fair enough! You gotta draw the line somewhere. But that's still being very selective.
- poly2it 2mo agoWould Rust have made this issue impossible by construction? I know Linus has spoken about Rust's promises about memory safety not being equivalently applicable in the kernel domain, so I would be curious to hear any kernel developer's perspectives.
- rwaksmunski 2mo agoThe Rust ownership model prevents use after free. This type of a bug would not compile.
- _flux 2mo agoYou might not be able to express the ownership in the way that can be checked statically, so quite possibly this would then be downgraded to a runtime error (that could be handled with a panic)—but not undefined behavior.
- anoneng 2mo agoNot necessarily. Rust safety relies on OS primitives and the error here is in an OS primitive itself (kernel semaphores). Yes Rust is one language that can be widely deployed in systems programming and potentially avoid classes of memory and ownership errors. No it doesn’t magically solve all the problems. Saying “Rust would fix this” in a hypothetical situation where Rust existed in 1995 or OpenBSD was rewritten from scratch, ok, well maybe. As of today only research kernels and a very small fraction of Linux systems have been written in Rust when we are talking about kernels. People without systems and embedded programming experience need to sit down.
- dezgeg 2mo agoI don't think this is about core kernel semaphores but rather the SysV semaphore system calls?
- klodolph 2mo agoRust is designed to make this type of issue impossible, but that assumes that you can correctly encode object lifetimes in the kernel in a way that allows the compiler to check them. So I would say that any easy answer like “this would not compile” would just be a guess, because you would want to know more of the particulars in order to answer this question. I know that this is kind of a non-answer, but if you want to write a kernel in Rust you have to figure out boundaries for where unsafe {} are. In a kernel, there are probably large chunks of unsafe {} and the Rust compiler prevents certain bugs outside unsafe {} assuming there aren’t bugs inside unsafe {} that would prevent the type checker from doing its job correctly.
- bitwize 2mo ago[flagged]
- applfanboysbgon 2mo agoThe OpenBSD project was started in 1995, with ancestry going back further than that. Should they have first invented Rust? Or at what point do you suppose the decades-old codebase should have been completely rewritten?
- JCattheATM 2mo agoIt's not too late to start now, similar to how Linux did a few years back.
- tosti 2mo agoRumours of Linux being rewritten in Rust are greatly exaggerated.
- JCattheATM 2mo agoNo one is claiming that, they are at least setting a foundation for that to be possible though.
- anoneng 2mo agoTell us you know nothing about kernel programming and trust stacks while you are at it.
- convolvatron 2mo agoI know a lot about kernel programming. and the last thing as I would ever suggest as being core to kernel programming is that is a specialized discipline that uses different rules and shouldn't be accessible to neophytes. its just code. sometimes the restrictions are unfamiliar, but there is nothing magic going on here.
- tiffanyh 2mo agoCan anyone find the mailing list thread on this topic (or does it not exist because @security are private mailing list)? I did find another use-after-free bug from a couple months ago on the mailing list: https://marc.info/?t=177581065500002&r=1&w=2 https://marc.info/?t=177581065500002&r=1&w=2
- IveSeenItAll 2mo agoOh, hey, a local-user-to-root exploit on OpenBSD. Cool! Those are rare, but not unheard of, unless you're talking about Windows or Linux, where you don't hear much about this bug class, just since it's common-as-rainfall. Anyway... Does this mean OpenBSD is suddenly less interesting? Nope, it's still pretty much the best-understandable general-purpose OS, ready for your RiiR fork. So, still go for that! Burn a universe or two worth of tokens! For the planet! Does this mean OpenBSD is suddenly less secure? Nah... Its practical security level was never that much higher than that of its nominal competitors, despite Theo's best attempts, the best of which were replicated elsewhere and majority of it went ignored. The first class counts as "innovations", the rest as "experiments" which, no matter what anyone thinks, is not the same as "failed innovations." But I digress. Now, go and donate to OpenSSH (because I bet you typed ssh today, didn't you, you rascal?), publish your OxidizedBSD fork, or whatever. Just don't link to that "is OpenBSD secure?" site, because, well, gauche, dude(tte)!
- sgt 2mo agoNow I've seen it all.
- IveSeenItAll 2mo agoI've pondered it for an entire day, and I still have no idea what that means...
- rs_rs_rs_rs_rs 2mo agoI think it's important to point out that OpenBSD is not more secure than others, it's just that it's not widely adopted so no one really does audit it.
- mikem170 2mo ago> no one really does audit it Isn't this article about an AI that just audited it? > not more secure than others Didnt the audit only found one bug, much less than other kernels from the same audit?
- trashb 2mo agoOne bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.
- sunshine-o 2mo agoExactly, the entire AI industry has been trying to create an AI powered security arm race. I am not necessarily blaming them. Hard to know how much has been thrown into this but I would bet a lot. So far I have been very surprised we haven't been flooded by those type of announcements. If you look you will always find something and OpenBSD is the top price.
- cratermoon 2mo agoThey are throwing tokens at codebases and finding mostly vulnerabilities in cases that have not been worth the limited time and effort of the chronically underfunded and understaffed professional groups. There’d be a lot more value in the companies giving the money they spend on their synthetic text extruders to the organizations doing quality security research work.
- anuramat 2mo ago> they are ... finding ... vulnerabilities ... that have not been worth the time and effort ... that's kinda the entire point
- dTal 2mo agoThe point of the comment you are replying to is that it's also not worth the time and effort to use LLMs to find vulnerabilities, if "time and effort" can be measured with "money". If you factor in all the money spent on training, GPU data centers etc, it's not actually a financially efficient way to find bugs unless you profit from creating demand for LLMs. LLMs aren't cheaper than humans per unit work, yet. They're just massively deficit funded because capital thinks "AI" is going to reshape the world order, and wants in.
- quotemstr 2mo ago[dead]
- WhereIsTheTruth 2mo agoAh, it was too good to be true, BSD too is becoming rusty.. ahh, what's left?
- sys_64738 2mo agoAnybody know why the compiler didn't pick this up?
- beeeliveee 2mo agowhere poc? no poc = hyped false marketing from openai, lying about it is lpe. same with claude bug 27y.