Skip to content

Commit 3f68f34

Browse files
committed
tcache_relative_write is obsolete due to the large chunk caching mechanism
1 parent 45a6cd0 commit 3f68f34

File tree

2 files changed

+1
-200
lines changed

2 files changed

+1
-200
lines changed

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ We came up with the idea during a hack meeting, and have implemented the followi
4343
| [tcache_dup.c](obsolete/glibc_2.27/tcache_dup.c)(obsolete) | | Tricking malloc into returning an already-allocated heap pointer by abusing the tcache freelist. | 2.26 - 2.28 | [patch](https://sourceware.org/git/?p=glibc.git;a=commit;h=bcdaad21d4635931d1bd3b54a7894276925d081d) | |
4444
| [tcache_metadata_poisoning.c](glibc_2.27/tcache_metadata_poisoning.c) | | Trick the tcache into providing arbitrary pointers by manipulating the tcache metadata struct | >= 2.26 | | |
4545
| [house_of_io.c](glibc_2.31/house_of_io.c) | | Tricking malloc into return a pointer to arbitrary memory by manipulating the tcache management struct by UAF in a free'd tcache chunk. | 2.31 - 2.33 | | |
46-
| [tcache_relative_write.c](glibc_2.41/tcache_relative_write.c) | | Arbitrary decimal value and chunk pointer writing in heap by out-of-bounds tcache metadata writing | >= 2.30 | | |
46+
| [tcache_relative_write.c](glibc_2.41/tcache_relative_write.c) | | Arbitrary decimal value and chunk pointer writing in heap by out-of-bounds tcache metadata writing | 2.30-2.41 | [patch](https://sourceware.org/git/?p=glibc.git;a=commit;h=cbfd7988107b27b9ff1d0b57fa2c8f13a932e508) | |
4747

4848
The GnuLibc is under constant development and several of the techniques above have let to consistency checks introduced in the malloc/free logic.
4949
Consequently, these checks regularly break some of the techniques and require adjustments to bypass them (if possible).

glibc_2.42/tcache_relative_write.c

Lines changed: 0 additions & 199 deletions
This file was deleted.

0 commit comments

Comments
 (0)