Linux Heap Calloc Exploitation

In this paper, I introduce the reader to a heap metadata corruption against a recent version of the Linux Heap allocator before the introduction of the tcache. Normally, calloc will allocate data and zero out the memory before returning a pointer to it. An attacker that can overflow from one chunk into a free chunk can force calloc to return uninitialised data. This information leak could be utilised to defeat ASLR or expose sensitive information.


Linux Heap Calloc Exploitation.PDF