OpenBSD SysV semaphore use-after-free enables local root privilege escalation

sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().

• OpenBSD: the CNA affected record identifies OpenBSD from version 0 through 7.9 inclusive as affected. The record gives a default status of unaffected outside that range, but it does not detail separately verified parallel branches or builds.
• The OpenBSD source patch fixes the SysV semaphore subsystem, but the record does not name a specific release or errata version containing the fix. Do not infer that a later or parallel branch is fixed without separate verification.

The flaw is in the local system-call path for sys_semget() in the SysV semaphore subsystem, within sys/kern/sysv_sem.c. It is a use-after-free that occurs after tsleep during a context switch, allowing kernel code to continue using a semaphore object after it has been freed. The source fix adds reference counting for semaphores and changes object release handling so the object remains valid while it is in use.

The specific attacker-controlled values or call sequence needed to trigger the flaw are not established by the available evidence. The affected path requires local execution, and the supplied assessments indicate that no user interaction is needed. The required privilege level and attack complexity are disputed between the supplied assessments, so the exact trigger conditions should be verified in the deployed environment.

The vulnerability is locally reachable through the kernel's SysV semaphore path and is described as enabling local privilege escalation to root. The supplied assessments agree that user interaction is not required, but they differ on preconditions: the CNA describes no required privileges and high complexity, while NVD assesses low privileges and low complexity.

The record marks public exploit availability as false. CISA enrichment in the supplied record also describes exploitation as none; that is the scope of the available assessment and does not prove that exploitation has never occurred or will not emerge later. No specific campaign, victim, payload, or exploit sequence is confirmed.

The flaw can turn local code execution into root access because a semaphore object is used after it has been freed. The record describes potential impact to system confidentiality, integrity, and availability, but does not specify the exploitation primitive or the degree of control available before escalation.

The differing assessments of initial privileges and attack complexity leave the exact operational conditions uncertain. The described scope does not cross into a different security authority, and there is no evidence in the supplied material of use in a specific attack.

A successful exploit could elevate a local process to root, defeating the system's privilege boundary. That level of access could allow an attacker to read data unavailable to the original process, alter system configuration or files, and disrupt services; these are possible consequences of root access, not evidence of a particular compromise.

The main exposure is on OpenBSD hosts where users or services can execute local code. The available evidence does not identify a victim, campaign, or confirmed real-world attack.

1. Apply the OpenBSD source fix for sys/kern/sysv_sem.c. The patch adds semaphore reference counting and addresses the use-after-free after tsleep in sys_semget().
2. If OpenBSD is built from source, verify that the corresponding change is present in the source tree and that the running kernel was built from that tree. The available evidence does not provide an exact release version to use as a replacement boundary.
3. Until the fix can be applied, reduce local code execution opportunities for unprivileged users and services on affected systems. This is temporary exposure reduction, not a substitute for patching.
4. After remediation, recheck version inventory, kernel provenance, and any OpenBSD systems still within the affected range through 7.9.

1. Inventory systems running OpenBSD and identify the kernel or userland version corresponding to OpenBSD versions from 0 through 7.9 inclusive.
2. Check kernel build provenance, errata, or source history to determine whether the fix for sys/kern/sysv_sem.c has been integrated. The fix is described as adding reference counting for SysV semaphores to address the context-switch use-after-free after tsleep in sys_semget().
3. Identify systems that allow unprivileged users or services to execute local code, because local execution is the confirmed reachability condition.
4. As a precaution, review telemetry for unusual local processes, unexpected privilege changes, or unplanned system-state changes. These are not confirmed indicators for this vulnerability, and the absence of suitable log evidence does not prove safety.