House of Einherjar — Yet Another Heap Exploitation Technique on GLIBC
summary
Proposes a new glibc heap exploit called House of Einherjar that uses an off-by-one overflow to clear the prev_inuse bit, corrupt the previous chunk size and force malloc to consolidate backward so it returns an attacker-controlled address. Demo runs on x86_64 glibc, builds a fake chunk on stack, edits its size at free time and then mallocs the target region; it works but requires two address leaks and a nearby controllable chunk, and avoids the huge allocations House of Force needs.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:12Overview and target environments
- 5:08GLIBC chunk structure
- 13:07Chunk consolidation
- 21:15House of Einherjarの原理と条件
- 27:54Attack steps and demo
- 33:08Attack evaluation
- 35:13Mitigations and future work
related talks
22mDemostrating Binary Exploitation
48m"Attacking the TCache in GLibc 2.32"
01h 00mIntroduction to memory exploitation
58mDemonstrating binary exploitation
26mA new exploitation method to bypass stack canaries
51mThe Anatomy of an Exploit
32mPoking Holes in Information Hiding
36mExploiting Buffer Overflows on RISC-V