Laura this is for you! *:-”*

(That is a ascii kiss)

The history was something like this:

• My boss assigned me the exploit, more like a curiosity to investigate. There were very few info about the bug, and no PoC.
• A week later, testing a primitive ipv6 “fuzzer” on a OpenBSD 4.0 box, a managed to get a crash similar to this:

  

• In the next few days, I made a impact module with the then-i-believe-to-be DoS, and others projects got my atention.

• Some days later, it occured to my to test the PoC with a OpenBSD 4.1 Box, supposedly patched, and oh surprise:The box also crashed! I was having a Zero-day on my hands.

• The OpenBSD team was immediately advised about this. They beleived that it was only a crash, and no code execution could be attained from this. They pretty much dismissed the bug, and label the patch a “Reliability fix”. My name wasn’t even on the bug report, and I became a little bitter about the subjet, but soon forget about it.

• A couple of weeks later, boring on a Saturday Night (I was such a looser, haha!), decided to give it a try and make the exploit for the bug. I was getting a pretty reliable crash on the m_freem() kernel function, so should be a way to exploit that.
• That day, working non-stop like 10 hours or so, I managed to get code execution on that bug. Sleep a couple of hours (I was very impacient) and back to work: This time i managed to execute code and get the kernel to continue with normal execution. It was great!
• The next morning on the office, i silently modified the advisory, changing the “DoS” title, with a “Remote Exploit”. Woot!

Then a bunch of very hilarious discussions were insued between Core and the OpenBSD team (Specially Theo), and is detailed on the advisory. Then the advisory was published, all went crazy for a couple of days. The manager of the Marketing team of Core was very thankfull of me and give me some words of support.

Thats all. I am not really a blog man, but is kind of required for blackhat, so here is. I will gladly respond any question, post a comment entering “comment”. bye!