glibclibrary provides functions such as
mallocto help developers manage the heap memory according to their use cases. It is the responsibility of the developer to:
freeany memory he/she has obtained using
- Do not
freethe same memory more than once.
- Ensure that memory usage does not go beyond the amount of memory requested, in other terms, prevent heap overflows.
Failing to do makes the software vulnerable to various kinds of attacks. Shellphish, a famous Capture the Flag team from UC Santa Barbara, has done a great job in listing a variety of heap exploitation techniques in how2heap. Attacks described in "The Malloc Maleficarum" by "Phantasmal Phantasmagoria" in an email to the "Bugtraq" mailing list are also described.
A summary of the attacks has been described below:
This is not an attack, it just demonstrates the nature of glibc's allocator
Disrupt the fastbin by freeing a chunk twice
Disrupting fastbin link structure
Getting (nearly)arbitrary write access
Freeing a corrupted chunk and exploiting
Shrinking Free Chunks
Corrupting a free chunk by decreasing its size
House of Spirit
Forcing freeing of a crafted fake chunk
House of Lore
Disrupting smallbin link structure
House of Force
Overflowing into top chunk's header
House of Einherjar
Overflowing a single byte into the next chunk