Class 09 · KP 15 / 25

Safe-Linking: Blunting Poisoning (glibc 2.32)

Safe-linking obfuscates single-linked list pointers (tcache and fast bins).
Instead of storing a raw next, glibc stores next XOR (address_of_pointer >> 12).
Effect: to forge a working next, the attacker must know the location of the pointer (a heap address). A blind overwrite produces a garbage, mis-aligned pointer that fails alignment checks.
It is mitigation, not prevention: with a heap info leak, an attacker can recompute the mask and still poison the list.

Key Takeaway

Safe-linking raises the bar — poisoning now generally requires a heap leak first, echoing the ASLR arms race.