Understand Heap Exploitation Concepts

Heap Exploitation Concepts

Heap exploitation targets dynamic memory management bugs rather than stack overflows. Corrupting heap metadata via malloc/free bugs can lead to arbitrary memory writes and code execution.

Heap Chunk Structure and Vulnerabilities

A glibc heap chunk contains:

• size: chunk size including metadata (low 3 bits are flags)
• fd / bk: forward/backward pointers in free lists
• User data starts after the metadata header

Key vulnerability classes:

• Use-after-free: dangling pointer points to reallocated attacker-controlled data
• Double-free: freeing the same chunk twice corrupts free list linking
• Heap overflow: writing past a buffer overwrites the next chunk's metadata

For example, a double-free of chunk A can cause malloc to return the same address twice, giving two pointers to one allocation.

For This Exercise

You will document heap chunk structure, vulnerability types, and modern allocator defenses like safe unlinking and tcache integrity checks. Heap bugs are the dominant vulnerability class in browsers and complex applications today.

Modern Heap Defenses

Glibc's safe unlinking checks that fd->bk == chunk before removing a free chunk from a doubly linked list. Tcache (per-thread cache) added in glibc 2.26 speeds allocation but introduced new double-free checks. Safe-linking XOR-mangles pointers in recent versions. Despite defenses, heap bugs remain the top vulnerability class in browsers, where attackers combine UAF with JavaScript type confusion for reliable exploitation.