Linux Heap TCache Free Chunk Information Disclosure


In this paper, I introduce the reader what is in a free tcache chunk. There are two pointers maintained in these free chunks that leak information about the address layout and internal allocator structures. This paper will discuss those leaks.

Linux Heap TCache Free Chunk Information Disclosure.PDF 

Comments

Post a Comment

Popular posts from this blog

Linux Heap TCache Poisoning

Linux Heap TCache Poisoning In this paper, I introduce the reader to a heap metadata corruption against the current Linux Heap Allocator, ptmalloc. The attack is performed via corrupting, or poisoning the tcache such that malloc returns an arbitrary pointer. This may allow for control flow hijacking if malloc returns a pointer to a function pointer and an attacker is able to write to that malloc returned buffer. TCache poisoning is possible from heap corruption including buffer overflows and Use-After-Frees.

Linux Heap TCache Poisoning.PDF
Read more

Linux Heap glibc 2.27 Double Free Exploitation

In this paper, I introduce the reader to a heap metadata corruption against the glibc 2.27 Linux Heap Allocator, ptmalloc. This attack is mitigated in the most recent 2.29 glibc. An attacker that forces the application to perform a double free can manipulate it to make malloc return an arbitrary pointer. This is achieved, by having malloc return a chunk of memory whilst still remaining in the tcache freelist. The attacker is then able to manipulate this memory to perform tcache poisoning and force malloc to return an arbitrary pointer. This is a powerful primitive, and with appropriate application logic is equivalent of a write-what-where.

Linux Heap glibc 2.27 Double Free Exploitation.PDF

Read more