"Attacking the TCache in GLibc 2.32"
summary
Demonstrates a practical bypass of glibc 2.32’s safe‑linking by corrupting in‑heap tcache metadata to make malloc return allocator-controlled addresses. Uses double‑free / use‑after‑free and house‑of‑spirit primitives to free the tcash management struct (0x290), place libc addresses or the main‑arena unsorted_bin root into tcache list heads, leak libc, overwrite free_hook or top to overlap stack and achieve code execution. Works in lab with those app bugs and a libc heap leak; requires specific heap layout and list‑count (≤7) constraints. tcache list head poisoning and safe-linking bypass.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:12Memory management basics
- 2:37Inside malloc and chunks
- 6:31Thread cache and arenas
- 9:17Historical heap attacks
- 12:36Tcache exploitation techniques
- 15:47Early tcache mitigations
- 18:35Safe linking mechanism
- 24:43Bypassing safe linking
- 26:57Hook exploitation
- 30:02Controlling list heads
- 32:33Advanced tcache attacks
- 36:21Data and metadata confusion
- 37:30House of spirit attacks
- 38:53Gaining libc leaks
- 43:24Conclusion and future work
- 45:17Q&A
related talks
37mHouse of Einherjar — Yet Another Heap Exploitation Technique on GLIBC
26mA new exploitation method to bypass stack canaries
22mDemostrating Binary Exploitation
27mTranslation Leak-aside Buffer: Defeating Cache Side-channel Protections
36mStore-to-Leak Forwarding: There and Back Again
44mDebugging memory corruptions in C++
40mDirty Bin Cache: A New Code Injection Poisoning Binary Translation Cache
23mMalicious Management Unit: Why Stopping Cache Attacks in Software is Harder Than You Think