From 4cf2d869367e3813c6c8f662915dedb1f3830c53 Mon Sep 17 00:00:00 2001 From: Ben Kallus Date: Fri, 14 Feb 2025 00:34:54 -0500 Subject: [PATCH] malloc: Add integrity check to largebin nextsizes If attacker overwrites the bk_nextsize link in the first chunk of a largebin that later has a smaller chunk inserted into it, malloc will write a heap pointer into an attacker-controlled address [0]. This patch adds an integrity check to mitigate this attack. [0]: https://github.com/shellphish/how2heap/blob/master/glibc_2.39/large_bin_attack.c Signed-off-by: Ben Kallus Reviewed-by: DJ Delorie --- malloc/malloc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/malloc/malloc.c b/malloc/malloc.c index dcac903e2a..931ca48112 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -4244,6 +4244,9 @@ _int_malloc (mstate av, size_t bytes) fwd = bck; bck = bck->bk; + if (__glibc_unlikely (fwd->fd->bk_nextsize->fd_nextsize != fwd->fd)) + malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)"); + victim->fd_nextsize = fwd->fd; victim->bk_nextsize = fwd->fd->bk_nextsize; fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;