Double Frees in Chrome's Partition Alloc - part 2

Dr Silvio Cesare
@silviocesare


Summary

PartitionAlloc is the hardened heap allocator used in Google's Chrome web browser. It is susceptible to a number of attacks. This blog post describes the second attack in a series of posts. I will talk about double frees and how to make an allocation request return an arbitrary pointer. This can be used with application-logic to develop an arbitrary write primitive.

Introduction

In heap allocators, freelists maintain a group of free memory chunks that are available to be recycled by an allocation request. Freelist poisoning corrupts this list and injects a "fake chunk" pointer. A later allocation will return this fake chunk pointer. So it is possible to make an allocation request return an arbitrary pointer.

A double free often creates a cycle in the freelist. When a chunk is returned by an allocation request, the chunk still remains in the freelist. Thus, if an attacker writes to that chunk, it is use-after-free and akin to freelist poisoning.

ParitionAlloc Double Frees

PartitionAlloc, like many other allocators, has a trivial mitigation against double frees. It simply checks the last freed pointer with the pointer currently being freed. Here is an example of a trivial double free.


And let's see the mitigation in effect, which triggers a SIGILL:


A simple method to defeat this trivial mitigation is to interleave the free of another pointer between the double free. This will create a cycle in the underlying freelist and subsequent allocations will reflect this cycle.


And we can see the freelist cycle produces an infinite number of identical allocations reflecting the cycle that was created.


The important thing to note is that when one of those chunks is allocated, it still remains on the freelist. Thus, if we overwrite the data in a chunk, it's effectively the same as a use-after-free. Therefore, we can employ freelist poisoning. Let's do that:


 Let's run our complete exploit:


We can see we made PartitionAlloc return an arbitrary pointer. The application logic let us write to that, and we made the foo variable our desired value.

Conclusion

In this blog post, I demonstrated the classic double free poisoning attack against PartitionAlloc. This allocator has a number of mitigations and hardening strategies. However, attacks still exist. In future blog posts I will talk about other attacks against this allocator.

Comments

  1. Managerial Economics is a part of Management Studies which focuses on solving the problems of business by applying theories and principles of Microeconomics and Macroeconomics. It is a specialized profession dealing with internal issues of an organization by using various theories of economics. It is a branch of business studies that draws elements from economics as well as management studies. Managerial economics helps managers to utilize economic principles in order to make management decisions regarding production, human resources, marketing, and finance. Managerial economics helps managers in recognizing how economic factors affect organizations and describing the economic significance on managerial behavior. Managerial Economics can be applied to both, profit and non-profit organizations. It makes use of economic concepts to make logical managerial decisions. It also makes rules for improving managerial functioning. Managerial Economics is used to bridge the gap between problems of policy as well as problems of logic. Managerial economics Accounting help managers to operate efficiently by utilizing scarce humans and capital resources.

    Managerial Economics is an amalgamation of numerous subjects like arts, science, economics, management, mathematics, statistics, psychology, organizational behavior, sociology, etc. The subject is multi-disciplinary in nature and comprises of factors coming from one of these subjects or a few combined.

    ReplyDelete
  2. Thanks for sharing such a fantastic blog. Since the last few weeks, I am not finding your blogs that disappoint me a lot, as I love reading your posts. This article is really attractive, and I’m waiting for your new ideas as well. Hope to see your next blog as soon as possible. Technargle

    ReplyDelete
  3. This Blog is very informative for us. Thanks for writing it. In this article, some examples help me in applying in daily life. amazing You have explained each and everything very well in detail. I hope you will write more pieces which help us in our daily routines. https://groupxit.com/

    ReplyDelete
  4. Our Online Assignment Writing Service assists related to all the subjects across many countries across the globe. We cover the following content, and here students can get the exact solutions for the assignment's questions. It is what makes us the Best Assignment Writing Service Australia. Certain categories have been made for students so that they can have easy access. These consist of the following:
    Research paper writing (it is very common for students to get research papers to solve. These are usually for high school students. The major topics covered under this are – Literature, Science, Psychology, Chemistry, Physics, etc.; we provide authentic and genuine facts.)
    Essay writing ( it includes essays of all kinds like- descriptive essays, informational essays, descriptive writing, persuasive essay or any admission help related essays)
    Project work (it includes the projects that students get related to different theoretical subjects who need statistical knowledge and analytical skills.)

    ReplyDelete
  5. Really I'm very happy to found such a great post today, Peoples are always looking informative and creative ideas on the internet and I think you have to covered with both in this post. Calculus Textbook Solution Manuals

    ReplyDelete
  6. Let us comprehend the reasons why an understudy requires an Online Balance Sheet Assignment help. Initially, this subject includes huge loads of accounting ideas and phrasings, which are uncertain for some understudies. The balance sheet analysis assignment writing service has just distinguished them in the above area accurately. Besides, illuminating and examining a monetary record expects you to have a top to bottom comprehension of bookkeeping ideas, accounting proportions, accounting conditions, accounting equations, and the sky is the limit from there. Thirdly, you should be exceptionally precise at tackling it, as even a solitary mix-up can have a major effect yet to be determined aggregate. Fourthly, you have to follow a legitimate structure while composing your accounting assignment.
    There are just two different ways to defeat these issues; one can take the assistance of your educators, companions, or relatives; second, you can call an Analysis of Balance Sheet assignment help and request that he do your assignment.

    ReplyDelete
  7. Taking the risk of writing the CDR Reports might turn against your dream of getting a respectable civil engineering job in Australia. The primary reason you come to the platform must be to get assistance in CDR Report for Civil Engineer. You need not worry anymore because you are at the perfect destination, and getting wet will help you accomplish your desire to set a job in the field of Civil Engineering in Australia.

    ReplyDelete

Post a Comment

Popular posts from this blog

Heap Exploitation in Chrome's PartitionAlloc - part 1

Linux Kernel Stack Smashing

Sudoedit heap overflow