~/CSC 472/Class 09/KP 14

Class 09 · KP 14 / 25

tcache Poisoning, Visually

glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

After overwriting A->next, the free list appears to continue at TARGET.
malloc #1 returns A; malloc #2 returns TARGET.
Writing to the second allocation writes to the target address.