lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-30 22:43:12 +03:00
Code Activity

Harden tcache double-free check

Browse Source 
The tcache allocator layer uses the tcache pointer as a key to
identify a block that may be freed twice.  Since this is in the
application data area, an attacker exploiting a use-after-free could
potentially get access to the entire tcache structure through this
key.  A detailed write-up was provided by Awarau here:

https://awaraucom.wordpress.com/2020/07/19/house-of-io-remastered/

Replace this static pointer use for key checking with one that is
generated at malloc initialization.  The first attempt is through
getrandom with a fallback to random_bits(), which is a simple
pseudo-random number generator based on the clock.  The fallback ought
to be sufficient since the goal of the randomness is only to make the
key arbitrary enough that it is very unlikely to collide with user
data.

Co-authored-by: Eyal Itkin <eyalit@checkpoint.com>
This commit is contained in:
Siddhesh Poyarekar
2021-07-07 23:02:46 +05:30
parent f9c8b11ed7
commit fc859c3048
2 changed files with 41 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
malloc/arena.c
View File

@ -287,6 +287,10 @@ extern struct dl_open_hook *_dl_open_hook;
libc_hidden_proto (_dl_open_hook);
#endif
#if USE_TCACHE
static void tcache_key_initialize (void);
#endif
static void
ptmalloc_init (void)
{
@ -295,6 +299,10 @@ ptmalloc_init (void)
__malloc_initialized = 0;
#if USE_TCACHE
tcache_key_initialize ();
#endif
#ifdef USE_MTAG
if ((TUNABLE_GET_FULL (glibc, mem, tagging, int32_t, NULL) & 1) != 0)
{