[Heap Exploitation] Smallbin attack

Reference

• https://heap-exploitation.dhavalkapil.com/attacks/house_of_lore.html
• https://github.com/shellphish/how2heap/blob/master/house_of_lore.c

smallbin

About smallbin

• 총 62개의 small bin
• free될 때 앞,뒤 chunk가 free되었다면 병합(coalesce)
• 삽입은 HEAD, 제거는 TAIL (FIFO)

32bit

• size : 0x10, 0x18, 0x20 ...... , 0x1F8(504)
  (8x+8, 1<=x<=62) 

64bit

• size : 0x20, 0x30, 0x30 ...... , 0x3F0(1008)
  (16x+16, 1<=x<=62)

 

The code of getting chunk from smallbins in malloc

malloc - smallbin

if (in_smallbin_range (nb))   {     idx = smallbin_index (nb);     bin = bin_at (av, idx);       if ((victim = last (bin)) != bin)       {         if (victim == 0) /* initialization check */           malloc_consolidate (av);         else           {             bck = victim->bk;   if (__glibc_unlikely (bck->fd != victim))               {                 errstr = "malloc(): smallbin double linked list corrupted";                 goto errout;               }             set_inuse_bit_at_offset (victim, nb);             bin->bk = bck;             bck->fd = bin;               if (av != &main_arena)               victim->size |= NON_MAIN_ARENA;             check_malloced_chunk (av, victim, nb);             void *p = chunk2mem (victim);             alloc_perturb (p, bytes);             return p;           }       }   }

 

Attacks

House of Lore

공격개요

free된 후 smallbin에 들어간 chunk의 bk를 조작하여, 임의의 chunk를 smallbin에 넣는 공격

제약조건

• smallbin size의 chunk는 free된 후 unsorted bin에 들어가므로, 더 큰 크기를 할당하여 chunk를 unsorted bin→small bin으로 이동시켜야 한다.
• 아래와 같은 체크로직을 우회하기 위해 아래 조건을 만족해야 한다.
  • real_chunk→bk = fake_chunk
  • fake_chunk→fd = real_chunk
  • fake_chunk→bk = another_chunk
  • another_chunk→fd = fake_chunk

 

malloc - smallbin check

bck = victim->bk; if (__glibc_unlikely (bck->fd != victim))             {               errstr = "malloc(): smallbin double linked list corrupted";               goto errout;             }           set_inuse_bit_at_offset (victim, nb);           bin->bk = bck;           bck->fd = bin;