/Heap-Papers

Heap-Papers

Heap Exploitation Techniques

Name Description Reference
Fast bin dup Corrupting a fast bin freelist (e.g., by double free or write-after-free) to return an arbitrary location ---:
Unsafe unlink Abusing unlinking in a freelist to get arbitrary write [1][2][3]
House of chaos [5]
House of mind [5][9]
House of prime [5][9]
House of spirit Freeing a fake chunk of fast bin to return arbitrary location [5][9]
House of force Corrupting the top chunk to return an arbitrary location [5][9]
House of lore Abusing the small bin freelist to return an arbitrary location [5][9]
House of underground [9]
Poison null byte Corrupting heap chunk size to consolidate chunks even in the presence of allocated heap ---:
Overlapping chunks Corrupting a chunk size in the unsorted bin to overlap with an allocated heap ---:
Unsorted bin attack Corrupting a freed chunk in unsorted bin to write a uncontrollable value to arbitrary location ---:
Free chunk enlarge attack [14]
Nonadjacent free chunk consolidation attack [14]
Free chunk shrink attack [14]
House of einherja Corrupting PREV_IN_USE to consolidate chunks to return an arbitrary location that requires a heap address [15]
Unsorted bin into stack Abusing the unsorted freelist to return an arbitrary location [19]
House of unsorted einherjar A variant of house of einherjar that does not require a heap address [19]
Unaligned double free Corrupting a small bin freelist to return already allocated heap [19]
Overlapping small chunks Corrupting a chunk size in a small bin to overlap chunks [19]
Fast bin into other bin Corrupting a fast bin freelist and use malloc_consolidate() to return an arbitrary non-fast-bin chunk [19]

Secure Heap Allocator Design

  • Berger, Emery D., and Benjamin G. Zorn. "DieHard: Probabilistic memory safety for unsafe languages." Acm sigplan notices 41.6 (2006): 158-168.
  • Novark, Gene, and Emery D. Berger. "DieHarder: securing the heap." Proceedings of the 17th ACM conference on Computer and communications security. 2010.

Reading

# Year Title
1 2001 Vudo malloc tricks
2 2001 Once upon a free()...
3 2003 Advanced Doug lea’s malloc exploits
4 2004 Exploiting the wilderness
5 2005 The Malloc Maleficarum
6 2007 The use of set_head to defeat the wilderness
7 2007 Understanding the heap by breaking it
8 2009 Yet another free() exploitation technique
9 2009 Malloc Des-Maleficarum
10 2010 The house of lore: Reloaded
11 2014 The poisoned NUL byte, 2014 edition
12 2015 Glibc adventures: The forgotten chunk
13 2016 Ptmalloc fanzine
14 2016 New exploit methods against Ptmalloc of Glibc
15 2016 House of Einherjar
16 2017 Modular Synthesis of Heap Exploits
17 2018 Automatic Heap Layout Manipulation for Exploitation
18 2018 HeapHopper
19 2020 ArcHeap

|