Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD calif.io

Calif researcher Andrew Griffiths reported an OpenBSD kernel bug dating to the original BSD sources: a signed 16-bit shared-memory attachment counter could overflow, enabling a race-driven use-after-free that, combined with a separate out-of-bounds write, allowed local privilege escalation to root. Calif developed an exploit that worked with KARL, SMAP and SMEP enabled, and says the flaws were fixed in OpenBSD errata 026 and 018.