Class 09 · KP 13 / 25

tcache Poisoning: Arbitrary Allocation

glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

Goal: make malloc return an arbitrary address of the attacker's choosing — an arbitrary write primitive.
Recipe (unhardened tcache):
Free a chunk so it enters the tcache; its next pointer is now writable via a UAF or overflow.
Overwrite next with the target address.
malloc once (pops the real chunk), then malloc again — the allocator returns your target address.
Write through that pointer: arbitrary write achieved.
Common targets: a GOT entry, a saved return address, a function pointer, or (older glibc) a malloc hook.

Key Takeaway

Corrupting a free-list pointer converts a heap bug into "malloc returns whatever I want," the core heap primitive.