Pumping Iron on the Musl Heap – Real World CVE-2022-24834 Ex...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.nccgroup.com/research-blog/pumping-iron-on-the-musl-heap-real-world-cve-2022-24834-exploitation-on-an-alpine-mallocng-heap/
• Blog Title: Pumping Iron on the Musl Heap – Real World CVE-2022-24834 Exploitation on an Alpine mallocng Heap
• Suggested Section: 🎯 Binary Exploitation → Libc Heap (add a subsection for musl mallocng exploitation/heap grooming, incl. cycling offset) and/or 🐧 Linux Privilege Escalation → Docker Security (brief note that Alpine/musl changes heap assumptions in container targets)

🎯 Content Summary

What the post is about
NCC Group documents a real-world exploitation workflow for CVE-2022-24834 against Redis <= 7.0.11 running inside an Alpine Linux container using musl libc 1.2.4 and its mallocng allocator. Public exploits primarily targeted Ubuntu-like environments using glibc/ptmalloc2, and they failed in this Alpine/musl setup because allocator behavior changes key heap-layout assumptions.

Vulnerability recap: CVE...

🔧 Technical Details

Porting “contiguous mapping” heap exploits across allocators (ptmalloc2 → mallocng): When a vulnerability produces a huge linear out-of-bounds copy (e.g., 0x15555555 bytes), exploitation depends on keeping the entire span mapped and placing a victim allocation adjacent to the overflow buffer. On ptmalloc2 this can be achieved by extending the brk()-heap so it stays contiguous; on musl mallocng, allocations live in mmap()-backed slab “groups” of fixed-size “slots” and fully freed groups can be munmap()’d, creating holes. The trick is to heap-groom with mallocng’s group/slot lifecycle in mind to prevent unmapped gaps within the ~350 MiB copy range.

Lua-object corruption instead of allocator metadata corruption: If the allocator is hardened (guarded out-of-band metadata, cookies), attack higher-level language/runtime objects stored on the heap. In Lua 5.1, Table objects reference arrays of TValue...

🤖 Agent Actions

Updated src/binary-exploitation/libc-heap/README.md with a new musl mallocng exploitation section covering Alpine-specific heap grooming for giant linear overflows, cycling-offset mitigation, Lua-object corruption strategy, and debugging workflow using muslheap/GdbLuaExtension. Added concise muslheap mchunkinfo example and appended relevant references including the NCC Group blog and tooling links.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.nccgroup.com/research-blog/pumping-iron-on-the-musl-heap-real-world-cve-2022-24834-exploitation-on-an-alpine-mallocng-heap/

Content Categories: Based on the analysis, this content was categorized under "🎯 Binary Exploitation → Libc Heap (add a subsection for musl mallocng exploitation/heap grooming, incl. cycling offset) and/or 🐧 Linux Privilege Escalation → Docker Security (brief note that Alpine/musl changes heap assumptions in container targets)".

Repository Maintenance:

• MD Files Formatting: 936 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0