OpenBSD 7.9 Local Privilege Escalation: 37-Year-Old Shared-Memory Bug Chained to Root — Detection and Remediation Guide

---
title: Root Shell Spawned by Unprivileged Parent Process
title_note: Detects the most reliable observable outcome of local privilege escalation — an interactive root shell whose parent is a non-system, user-context process.
id: 9c1f4a2e-7b38-4d51-a6e9-2f8b3d5c7a01
status: experimental
description: Detects interactive shells running as root spawned from unusual parent processes, consistent with post-exploitation privilege escalation such as the OpenBSD 7.9 shared-memory kernel exploit chain.
references:
  - https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_shell:
    Image|endswith:
      - '/ksh'
      - '/sh'
      - '/bash'
      - '/csh'
  selection_flags:
    CommandLine|contains:
      - ' -i'
      - '-i '
  filter_parents:
    ParentImage|endswith:
      - '/sshd'
      - '/init'
      - '/systat'
      - '/cron'
      - '/rc'
  condition: selection_shell and selection_flags and not filter_parents
falsepositives:
  - Administrators using su/sudo from interactive sessions (tune with User context where available)
  - Legitimate cron-driven maintenance shells
level: high
---
title: Unusual System V Shared Memory Allocation Activity
title_note: The exploit's stage 1 exercises the shmget/shmat path atypically; bulk or repeated shm syscalls from non-database/non-multimedia processes are rare on OpenBSD infrastructure hosts.
id: 3d7e9b14-5a62-4f08-b1c4-8e2a6d9f5b73
status: experimental
description: Detects processes with names or paths atypical for shared-memory usage engaging in heavy SysV IPC activity, a precursor behavior in the OpenBSD shm integer-overflow exploit chain. Requires auditd/syscall telemetry or equivalent forwarded from the host.
references:
  - https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_exec_tmp:
    Image|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/home/'
  selection_exec_compiled:
    CommandLine|contains:
      - 'shmget'
      - 'shmat'
  filter_known_ipc_users:
    Image|contains:
      - 'postgres'
      - 'httpd'
      - 'nginx'
      - 'smtpd'
  condition: (selection_exec_tmp or selection_exec_compiled) and not filter_known_ipc_users
falsepositives:
  - Locally compiled administrative tooling
  - Application development activity on build hosts
level: medium
---
title: Unauthenticated or Failed Authentication Followed by Root Command Execution
title_note: Correlates low-privilege session establishment with sudden root-level command execution within a short window — the classic post-escalation pattern after an attacker lands a foothold.
id: 6a2c8f57-1e94-4b36-9d82-5c7f0a3b8e42
status: experimental
description: Detects su or sudo invocation patterns indicating a direct jump to root from accounts that do not normally hold administrative privileges, consistent with post-exploitation activity on OpenBSD infrastructure hosts.
references:
  - https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html
  - https://attack.mitre.org/techniques/T1548/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.privilege_escalation
  - attack.t1548.003
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/su'
      - '/sudo'
      - '/doas'
  filter_admin_users:
    User|contains:
      - 'admin'
      - 'sysadmin'
      - 'root'
  condition: selection and not filter_admin_users
falsepositives:
  - Helpdesk or break-glass accounts — maintain an explicit allowlist of authorized elevation accounts
level: medium

// Hunt 1: Privilege escalation outcome — root shells / uid transitions on OpenBSD hosts
// Lookback: 14 days. Tune host list to your OpenBSD estate.
let OpenBSDHosts = dynamic(["obsd-fw01", "obsd-fw02", "obsd-bastion01"]);
Syslog
| where TimeGenerated > ago(14d)
| where Computer in~ (OpenBSDHosts) or Computer has "obsd"
| where SyslogMessage has_any ("uid 0", "euid 0", "setuid", "root shell")
   or (ProcessName in~ ("su", "sudo", "doas") and SyslogMessage has "root")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

// Hunt 2: Anomalous process execution from writable/user directories on OpenBSD hosts
// Exploit PoCs are typically compiled and run from /tmp or a user home directory.
let OpenBSDHosts = dynamic(["obsd-fw01", "obsd-fw02", "obsd-bastion01"]);
Syslog
| where TimeGenerated > ago(14d)
| where Computer in~ (OpenBSDHosts) or Computer has "obsd"
| where SyslogMessage has_any ("/tmp/", "/var/tmp/", "/dev/shm/")
| where SyslogMessage has_any ("a.out", "exploit", ".c ", "cc ", "clang ", "gcc ")
   or SyslogMessage matches regex @"/tmp/[A-Za-z0-9_.-]{1,64}"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3: Compiler execution on production OpenBSD infrastructure hosts
// Compilers should not exist — or run — on firewalls/bastions. Their execution is a strong lead.
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("cc", "clang", "gcc", "make", "perl")
| where Computer has "obsd" or Computer has "openbsd"
| summarize ExecutionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ProcessName, bin(TimeGenerated, 1h)
| order by LastSeen desc;

-- Velociraptor hunt: post-exploitation triage on Unix-like infrastructure hosts
-- NOTE: Velociraptor has no native OpenBSD agent; deploy this against adjacent Linux collectors,
-- jump hosts, and any host where an agent can run, hunting for the SAME intrusion's lateral artifacts.
-- Focus: (1) processes running from ephemeral paths, (2) uid-0 processes with unusual parents,
-- (3) recently compiled binaries in writable directories.

-- Artifact 1: Processes executing from writable/ephemeral directories
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '^/(tmp|var/tmp|dev/shm|home)/'
   OR CommandLine =~ 'shmget|shmat|/tmp/[a-zA-Z0-9]'

-- Artifact 2: Root-owned interactive shells or recently created binaries in temp paths
SELECT Name, Pid, Ppid, Username, CommandLine, Exe, CreateTime
FROM pslist()
WHERE Username =~ 'root'
  AND Name =~ '(ksh|sh|bash|csh)$'
  AND CreateTime > now() - 86400

-- Artifact 3: Recently modified executables in writable directories (compiled PoC staging)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/tmp/**', '/var/tmp/**', '/dev/shm/**', '/home/*/**'])
WHERE Mtime > now() - 172800
  AND NOT IsDir
  AND FullPath =~ '(a\.out|\.elf$|exploit|poc|escalat|shm)'
ORDER BY Mtime DESC

#!/usr/bin/env bash
# openbsd-escalation-hardening.sh
# Verify patch state and apply compensating controls on OpenBSD 7.9 hosts
# Run as root. Test in staging first — syspatch requires reboot for kernel updates.

set -euo pipefail

echo "=== [1] Confirm OS version ==="
sysctl -n kern.version
uname -r

echo "=== [2] Check and apply pending binary patches (kernel fixes ship via syspatch) ==="
syspatch -c   # list pending patches
# Apply all outstanding errata — the shm/integer-overflow fix ships here:
# syspatch

echo "=== [3] Verify errata against the official page ==="
echo "Cross-reference applied patches with https://www.openbsd.org/errata.html"

echo "=== [4] Inventory local accounts — every shell is a potential escalation launchpad ==="
awk -F: '($7 !~ /(nologin|false)/) {print $1":"$3":"$7}' /etc/passwd

echo "=== [5] Lock down doas — restrict privilege elevation to named admins only ==="
if [ -f /etc/doas.conf ]; then
  cat /etc/doas.conf
else
  echo "permit persist :wheel" > /etc/doas.conf
  chmod 0600 /etc/doas.conf
fi

echo "=== [6] Remove compilers from production infrastructure hosts ==="
# compXX.tgz set presence check — compilers should not exist on firewalls/bastions
for cc in /usr/bin/cc /usr/bin/clang /usr/bin/gcc; do
  [ -x "$cc" ] && echo "WARNING: compiler present at $cc — remove comp set if not required"
done

echo "=== [7] Enable and verify syslog forwarding to your SIEM collector ==="
grep -E '^\*\.*\s+@' /etc/syslog.conf || echo "WARNING: no remote syslog forwarding configured"
rcctl check syslogd && echo "syslogd running"

echo "=== [8] Audit recent privilege-elevation activity ==="
grep -E '(su|doas|sudo)' /var/log/authlog | tail -n 50 || true

echo "=== [9] Confirm wxallowed mounts are not exposed ==="
mount | grep -E 'wxallowed' && echo "WARNING: wxallowed filesystem present — remove unless strictly required" || echo "No wxallowed mounts — good"

echo "=== Done. Reboot if a kernel syspatch was applied. ==="