Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

Automated excerpt

Map 127 SysV shared memory segments, unmap them via munmap(), and fork 259 processes to wrap the shared memory attach count to -32,643. Clean up shared memory accounting and restore the overwritten kernel pointer to obtain a root shell. Thirdly, the kernel allocator can be made non-deterministic using two approaches; by randomizing the base address where memory allocations occur at boot time, and additionally randomizing the allocation order at run time.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.