Linux Heap Fast Bin Poisoning part 2

In this paper, I introduce the reader to a heap metadata corruption against the current Linux Heap allocator, ptmalloc. The attack is performed via corrupting, or poisoning the fast bin such that malloc returns an arbitrary pointer. It relaxes the requirements in part 1 of this paper and can now return an arbitrary pointer. For this to happen, more heap grooming is required.

Linux Heap Fast Bin Poisoning part 2.PDF

Popular posts from this blog

Pointer Compression in V8

C++ Memory Corruption (std::string) - part 4

C++ Memory Corruption (std::vector) - part 2