Class 09 · KP 08 / 25

tcache Hardening in Newer glibc

glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

Later glibc versions added integrity checks to the tcache:

tcache key (glibc 2.29): each freed tcache chunk stores a key field. On free, if the key already marks the chunk as cached, malloc suspects a double-free and aborts.
Count tracking: a per-bin counter guards against overflowing the list length.
Safe-linking (glibc 2.32): the next pointer is obfuscated (XORed with a secret derived from its own address). A blind overwrite no longer yields a usable pointer.
Alignment checks (glibc 2.32+): allocations from the tcache must be aligned, blocking some poisoning targets.

Key Takeaway

The tcache key and safe-linking are the main reasons modern heap exploits are harder than 2017-era ones — but bypasses exist.