Heap Functions Security Checks

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

For more info check:

pageunlink

This is a summary of the performed checks:

  • Check if the indicated size of the chunk is the same as the prev_size indicated in the next chunk

    • Error message: corrupted size vs. prev_size

  • Check also that P->fd->bk == P and P->bk->fw == P

    • Error message: corrupted double-linked list

  • If the chunk is not small, check that P->fd_nextsize->bk_nextsize == P and P->bk_nextsize->fd_nextsize == P

    • Error message: corrupted double-linked list (not small)

_int_malloc

For more info check:

pagemalloc & sysmalloc
  • Checks during fast bin search:

    • If the chunk is misaligned:

      • Error message: malloc(): unaligned fastbin chunk detected 2

    • If the forward chunk is misaligned:

      • Error message: malloc(): unaligned fastbin chunk detected

    • If the returned chunk has a size that isn't correct because of it's index in the fast bin:

      • Error message: malloc(): memory corruption (fast)

    • If any chunk used to fill the tcache is misaligned:

      • Error message: malloc(): unaligned fastbin chunk detected 3

  • Checks during small bin search:

    • If victim->bk->fd != victim:

      • Error message: malloc(): smallbin double linked list corrupted

  • Checks during consolidate performed for each fast bin chunk:

    • If the chunk is unaligned trigger:

      • Error message: malloc_consolidate(): unaligned fastbin chunk detected

    • If the chunk has a different size that the one it should because of the index it's in:

      • Error message: malloc_consolidate(): invalid chunk size

    • If the previous chunk is not in use and the previous chunk has a size different of the one indicated by prev_chunk:

      • Error message: corrupted size vs. prev_size in fastbins

  • Checks during unsorted bin search:

    • If the chunk size is weird (too small or too big):

      • Error message: malloc(): invalid size (unsorted)

    • If the next chunk size is weird (too small or too big):

      • Error message: malloc(): invalid next size (unsorted)

    • If the previous size indicated by the next chunk differs from the size of the chunk:

      • Error message: malloc(): mismatching next->prev_size (unsorted)

    • If not victim->bck->fd == victim or not victim->fd == av (arena):

      • Error message: malloc(): unsorted double linked list corrupted

      • As we are always checking the las one, it's fd should be pointing always to the arena struct.

    • If the next chunk isn't indicating that the previous is in use:

      • Error message: malloc(): invalid next->prev_inuse (unsorted)

    • If fwd->bk_nextsize->fd_nextsize != fwd:

      • Error message: malloc(): largebin double linked list corrupted (nextsize)

    • If fwd->bk->fd != fwd:

      • Error message: malloc(): largebin double linked list corrupted (bk)

  • Checks during large bin (by index) search:

    • bck->fd-> bk != bck:

      • Error message: malloc(): corrupted unsorted chunks

  • Checks during large bin (next bigger) search:

    • bck->fd-> bk != bck:

      • Error message: malloc(): corrupted unsorted chunks2

  • Checks during Top chunk use:

    • chunksize(av->top) > av->system_mem:

      • Error message: malloc(): corrupted top size

tcache_get_n

  • Checks in tcache_get_n:

    • If chunk is misaligned:

      • Error message: malloc(): unaligned tcache chunk detected

tcache_thread_shutdown

  • Checks in tcache_thread_shutdown:

    • If chunk is misaligned:

      • Error message: tcache_thread_shutdown(): unaligned tcache chunk detected

__libc_realloc

  • Checks in __libc_realloc:

    • If old pointer is misaligned or the size was incorrect:

      • Error message: realloc(): invalid pointer

_int_free

For more info check:

pagefree
  • Checks during the start of _int_free:

    • Pointer is aligned:

      • Error message: free(): invalid pointer

    • Size larger than MINSIZE and size also aligned:

      • Error message: free(): invalid size

  • Checks in _int_free tcache:

    • If there are more entries than mp_.tcache_count:

      • Error message: free(): too many chunks detected in tcache

    • If the entry is not aligned:

      • Error message: free(): unaligned chunk detected in tcache 2

    • If the freed chunk was already freed and is present as chunk in the tcache:

      • Error message: free(): double free detected in tcache 2

  • Checks in _int_free fast bin:

    • If the size of the chunk is invalid (too big or small) trigger:

      • Error message: free(): invalid next size (fast)

    • If the added chunk was already the top of the fast bin:

      • Error message: double free or corruption (fasttop)

    • If the size of the chunk at the top has a different size of the chunk we are adding:

      • Error message: invalid fastbin entry (free)

_int_free_merge_chunk

  • Checks in _int_free_merge_chunk:

    • If the chunk is the top chunk:

      • Error message: double free or corruption (top)

    • If the next chunk is outside of the boundaries of the arena:

      • Error message: double free or corruption (out)

    • If the chunk is not marked as used (in the prev_inuse from the following chunk):

      • Error message: double free or corruption (!prev)

    • If the next chunk has a too little size or too big:

      • Error message: free(): invalid next size (normal)

    • If the previous chunk is not in use, it will try to consolidate. But, if the prev_size differs from the size indicated in the previous chunk:

      • Error message: corrupted size vs. prev_size while consolidating

_int_free_create_chunk

  • Checks in _int_free_create_chunk:

    • Adding a chunk into the unsorted bin, check if unsorted_chunks(av)->fd->bk == unsorted_chunks(av):

      • Error message: free(): corrupted unsorted chunks

do_check_malloc_state

  • Checks in do_check_malloc_state:

    • If misaligned fast bin chunk:

      • Error message: do_check_malloc_state(): unaligned fastbin chunk detected

malloc_consolidate

  • Checks in malloc_consolidate:

    • If misaligned fast bin chunk:

      • Error message: malloc_consolidate(): unaligned fastbin chunk detected

    • If incorrect fast bin chunk size:

      • Error message: malloc_consolidate(): invalid chunk size

_int_realloc

  • Checks in _int_realloc:

    • Size is too big or too small:

      • Error message: realloc(): invalid old size

    • Size of the next chunk is too big or too small:

      • Error message: realloc(): invalid next size

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Last updated