search

shellphish / how2heap

A repository for learning various heap exploitation techniques.
MIT License
7.13k stars 1.13k forks source link

The PoC of tcache poisoning no longer work on GLIBC 2.30 and above #117

Closed Zzorz closed 3 years ago

Zzorz commented 4 years ago

The PoC of tcache poisoning no longer work on GLIBC 2.30 and above. There's a small change in _int_malloc() at https://sourceware.org/git/?p=glibc.git;a=commit;h=77dc0d8643aa99c92bf671352b0a8adde705896f.

Kyle-Kyle commented 4 years ago

To fix the tcache poisoning poc. It is pretty simple. I'm going to fix it. But damn, this breaks some exploitation primitives.

Kyle-Kyle commented 4 years ago

resolved in commit https://github.com/shellphish/how2heap/commit/68fa3633f7bb88def7ba2d0d01050ce5526f2ec4

Kyle-Kyle commented 4 years ago

Not sure whether there is any other poc broken because of this patch. I will leave this issue open until we have done further checks.

Kyle-Kyle commented 3 years ago

after the refactor, everything is clean now. Thanks for the report!