Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD has a use-after-free allowing local privilege escalation to root

nvd.nist.gov

Post reply on HN
Print view View original

71–80 of 170 posts

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#71

Post by brynet »

ptx wrote: post #64
anonym29 wrote: post #6

Earlier quoted context omitted.

LPE (to root) is serious, but it's not a remote hole.

Is this functionality accessible from sandboxed processes? That would make a remote hole much more dangerous when one is found, anyway. The CVE seems to concern SysV semaphores and the pledge(2) man page doesn't seem to mention those.

No.

https://github.com/openbsd/src/blob/d5b0ed23b6fe61f0278c37a4...

Perhaps relevant, Students from the University of Southern Denmark released a paper earlier this month, which once again noted the fact that over ~90% of the OpenBSD base system uses pledge(2). Almost certainly all of the network speaking daemons in base do.

https://arxiv.org/abs/2607.03056

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#72

Post by bell-cot »

beanjuiceII wrote: post #65
trashb wrote: post #53

One bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.

one bug is all it takes

In theory.

But real defenses are generally multi-layered. And in that context, a Swiss cheese slice with only one hole is still extremely valuable.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#73

Post by t-3 »

kevincox wrote: post #47
wahern wrote: post #13

Earlier quoted context omitted.

According to https://openai.com/index/patch-the-planet/ Linux: 24 LPEs, plus many additional vulnerabilities. OpenBSD: 1 LPE. FreeBSD: 7 LPEs, plus many additional vulnerabilities. Not sure what that says, though. Perhaps the models are more likely to find Linux issues because of the training.

It is quite possible that Linux is the bigger target so it gets more focus. Vulnerabilities there are generally considered more valuable and notable. It would be very difficult to use these numbers to get a meaningful "more secure" stance as there are tons of variables.

From a quick search, Linux kernel is ~40 million loc, freebsd ~9 million, openbsd ~3 million. Number of bugs compared to lines of code leaves FreeBSD looking worse than Linux.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#74

Post by JCattheATM »

tosti wrote: post #46
JCattheATM wrote: post #42

Earlier quoted context omitted.

It's not too late to start now, similar to how Linux did a few years back.

Rumours of Linux being rewritten in Rust are greatly exaggerated.

No one is claiming that, they are at least setting a foundation for that to be possible though.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#75

Post by JCattheATM »

throwaway27448 wrote: post #50
JCattheATM wrote: post #39

Earlier quoted context omitted.

> OpenBSD's security stance being the stuff of legend, More so their marketing.

What does openbsd marketing look like?

Pretty sure you're familiar with their claims.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#76

Post by 1vuio0pswjnm7 »

TacticalCoder wrote: post #63
Tiberium wrote: post #4

Seems to be found as a part of Patch The Planet [0] which is basically OpenAI giving model access and Trail of Bits using them to find vulnerabilities in OSS projects. [0] https://openai.com/index/patch-the-planet/

Sidenote but... I read this on that link: dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in 2.92rel2: CVE-2026-4890 (opens in a new window), CVE-2026-4891 (opens in a new window), CVE-2026-4892 (opens in a new window), and CVE-2026-517 dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that…

"dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines."

Would be nice if OpenWRT would stop including it by default

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#77

Post by JCattheATM »

bell-cot wrote: post #72
beanjuiceII wrote: post #65

Earlier quoted context omitted.

one bug is all it takes

In theory. But real defenses are generally multi-layered. And in that context, a Swiss cheese slice with only one hole is still extremely valuable.

Well, that's where OpenBSD falls short, it lacks facilities to really enforce defense in depth - even NetBSD has some better features in this regard.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#78

Post by gnoack »

trashb wrote: post #53

One bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.

+1

It is also a testament to solid engineering and attention to good security practices in general. These still work, also against fancy new AI attackers.

When sophisticated attacks become cheaper to run, maybe it will (finally) be cheaper to do more solid engineering instead of doing it quick and dirty and ending up in indefinite bug-squashing mode.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#79

Post by dathinab »

Analemma_ wrote: post #69
beanjuiceII wrote: post #65

Earlier quoted context omitted.

one bug is all it takes

LPEs do need to be fixed, but for most people it's not a threat model they need to worry about.

this is a misconception

yes, most company settings don't run untrusted code, and OpenBSD is mostly used for servers not employee devices

but that doesn't mean LPEs aren't quite relevant, because they matter for pretty much everyone if combined with other vulnerabilities, like RCE, supply chain attack etc.

and while RCE are becoming less common, supply chain attacks have been increasingly more common

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#80

Post by JCattheATM »

amiga386 wrote: post #32
bitwize wrote: post #15

[flagged]

OpenBSD wouldn't say anything like that. They're well aware of the 40+ year old codebase's limitations, but accept it because they're not so stupid as to "rewrite it in " which will bring a million bugs. They've innovated again and again in the security space and aggressively bring in new security features like pf, OpenSSH, W^X enforcement, pledge(), arc4random(), ASLR, so many other things. Unlike, say, NPM, which c…

> aggressively bring in new security features like pf, OpenSSH, W^X enforcement, pledge(), arc4random(), ASLR, so many other things.

I'd say OpenSSH is a great tool, arc4random was great and pledge is interesting although doesn't do much for code that wasn't compiled with it (and they are still really lacking in ways to lock down apps for a 'security focused' OS), the rest is just their implementation of stuff that already existed not something they innovated.

Most of their reputation comes from a time when linux distros and windows had every service enabled and exposed by default, it just developed it's own momentum the way many myths do.

Post reply on HN