Questions tagged [heap-overflow]
A heap overflow is a class of memory corruption occurring on the heap. It can potentially be used to exploit the faulty program.
35 questions
2
votes
1
answer
330
views
Questions on GLIBC Heap Exploitation (House of Force)
This is with reference to Max Kamper's video on GLIBC heap exploitation and these articles I read
https://www.crow.rip/crows-nest/binexp/heap/house-of-force-i
https://www.crow.rip/crows-nest/binexp/...
- 209
0
votes
1
answer
289
views
Stack vs Heap exploit, which have more CVE documented?
I tried to google this topic but most of them are conflicting each other. On the other side, I found a case where I can use either stack (local variable) or heap for a dynamic string. It's C by the ...
- 133
20
votes
6
answers
11k
views
Do high level languages allow for buffer / heap overflow?
I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
- 235
1
vote
1
answer
1k
views
Heap overflow - strcpy() on x86_64 (64bit)
I'm stuck on the Heap1 challenge from Exploit Education.
After compiling the source code in a 64bit system, without any security mechanism, I try to overflow the heap in order to overwrite the main ...
- 21
1
vote
0
answers
278
views
How does glibc prevent malloc unlink exploits?
The classic malloc overflow, of overwriting pointers in a free chunk, to cause free() unlink to overwrite an arbitrary location with an arbitrary value, is no longer possible with modern glibc (...
- 317
1
vote
1
answer
900
views
Can a heap/mmap buffer overflow overwrite the stack
The following questions regard linux processes with a stack that grows downwards from the end of the process memory.
If I have a buffer overflow on the heap with unlimited size, are there any ...
- 11
1
vote
2
answers
302
views
Exploitation tactics for heap over-reading?
One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction:
Any non-exploitable read overflow get CVSS of 9.8, like VLC is a ...
- 163
0
votes
1
answer
506
views
Microsoft Outlook Vulnerability CVE-2018-8587 - How likely is exploitation?
I found an interesting blog post A Deep Analysis of the Microsoft Outlook Vulnerability CVE-2018-8587 about Microsoft Outlook heap buffer overflow vulnerability where is described how Microsoft ...
- 612
1
vote
1
answer
780
views
What is Return-Oriented Programming? [closed]
With return-oriented programming, when we fill a buffer with the stack contents (arguments and return addresses) for the function calls we plan on "injecting," how do we actually change the stack ...
- 285
1
vote
0
answers
177
views
Need help in exploiting an overflow on Linux [closed]
There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string".
It's also possible to send about 10000 custom bytes to heap (it's possible to ...
- 11
1
vote
0
answers
366
views
Exploiting a Heap Overrun Vulnerability
I am really trying to understand the concept of the attack made possible by the code given below.
I notice that strcpy is being used, which does not perform any boundary checks and therefore enables ...
- 317
1
vote
0
answers
140
views
want to know about heap exploit
I am practicing my heap exploit skill with following website.
http://hatriot.github.io/blog/2014/09/21/protostar-heap-exploits/.
But under the title of heap 3 exploit,
I didnot understand with what ...
- 71
1
vote
2
answers
9k
views
Buffer overflows on the heap vs the stack
It is my current understanding that in order to successfully exploit a stack-based buffer overflow vulnerability, we must first overflow the buffer, thus overwriting the return pointer and gaining ...
- 636
1
vote
1
answer
261
views
Is it a win for an attacker, if they overflow the most recently malloc'd buffer on the heap?
If I call malloc and then overflow the buffer I created, I am then writing to unused memory. Is there any security impact from me being able to do so? I would think you'd want to call malloc twice, ...
- 572
1
vote
0
answers
426
views
Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?
Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them.
So, such filesystems if implemented in user space can suffer of buffer ...
- 1,512
2
votes
1
answer
973
views
Is it possible to execute code in this program using heap overflow?
Program code (with Pseudo code part):
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv)
{
int controlled1=10;
int controlled2=20;
int controlled3=300;
//test.bin ...
- 1,007
4
votes
2
answers
1k
views
Good example of heap exploits on Linux
I'm doing a demonstration of memory corruption attacks, and would like to show some working examples of exploits that feature heap corruption (such as use-after-free). My requirements are:
A working ...
- 317
0
votes
1
answer
593
views
Ubuntu 16.04 - malloc implementation. Where is the pointer to the next chunk? [closed]
I am trying to understand how the malloc implementation in glibc is working. According to the source code of malloc (malloc.c in glibc 2.23) free memory chunks have the following structure.
chunk-...
- 111
2
votes
1
answer
360
views
How can a modern Windows/Linux system be compromised by a heap overflow in Chrome?
Wikipedia's article on Heap Overflow states:
there are primarily three ways to protect against heap overflows.
Several modern operating systems such as Windows and Linux provide
some ...
- 133
5
votes
1
answer
1k
views
Why would a heap buffer overflow cause a crash on only some Windows 10 systems?
I have a stl::vector (VS 2010 SP1, x86) out-of-bounds read access attempt that causes a crash on only three Windows 10 systems. It is completely reproducible on those systems, but cannot be ...
- 151
1
vote
1
answer
2k
views
How to prevent from memcpy, cause Heap Overlflow?
I'm following Stanford CS155 security lesson's presentation to learn integer overflow. I learned today that memcpy() function may lead to overflow.
The presentation says, If I have a code something ...
- 11
13
votes
1
answer
9k
views
How to exactly create a CVE? [duplicate]
I found an heap overflow exploit for a vulnerability in git servers. This lead to lucrative operations on various bug bounty programs (GitHub already promised to put me in their top 10).
When it was ...
- 1,512
2
votes
1
answer
1k
views
Controlling where a program crashes
I'm missing a part of the process for preparing a payload for an overflow exploit. To crash a program using an overflow vulnerability, lets say the heap. How can we control the memory address it ...
- 385
2
votes
2
answers
2k
views
CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?
I am trying to understand how "Integer Overflow" happens here and how it works.
The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
- 1,007
2
votes
0
answers
697
views
How to write a PoC of heap-based ROP? [closed]
I want to write a Proof-of-Concept to exploiting any heap-based vulnerability(e.g. heap overflow, use-after-free) where my ROP(return-to-programming, a kind of code-reuse attacks) payload is deployed ...
- 29
2
votes
1
answer
1k
views
exploiting Heap Overflow in gdb segfaults
I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04.
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int n = 5;
...
- 191
9
votes
2
answers
927
views
When is memory allocation/layout deterministic?
I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer.
The classic "Smashing the ...
- 977
0
votes
3
answers
932
views
Drive-by downlad VS buffer and stack overflow attacks
Today malware is mainly spread thanks to vulnerabilities exploited in browsers and their plugins. The attackers use JavaScript to target those vulnerabilities. Two examples of such attacks are drive-...
user53675
0
votes
1
answer
2k
views
Does glibc use canary checking to prevent heap buffer overflow?
Since canary is used by gcc to prevent stack overflow (e.g. -fstack-protector), I am wondering whether glibc uses canary-based approach to defend heap buffer overflow? For example, this paper proposes ...
- 362
4
votes
2
answers
3k
views
Heap canaries, to protect function pointers in heap objects
I'm wondering if anyone has previously proposed, evaluated, or deployed the following measure to harden systems against heap-based buffer overruns: basically, stack canaries, but applied before ...
- 101k
1
vote
2
answers
2k
views
Heap spray against 64-bit processes - possible?
Are heap spray exploits possible, if the process we're attacking is a 64-bit process?
Naively, it seems like the 64-bit address makes it difficult to mount a heap spray: to fill all (or a significant ...
- 101k
4
votes
2
answers
761
views
Heartbleed and heap management - Why user data and passwords are kept in memory?
If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
- 2,768
1
vote
2
answers
348
views
What is the heapspray technique and how to use it as reliably as possible?
Can somebody explain the different steps to produce a heapspray attack (what are the needed vulnerabilities in the targeted software, what are the limitations of such technique, how to proceed, ...) ...
- 923
4
votes
3
answers
1k
views
Are stack & heap overflow exploits no longer effective?
Do all new OSes implement the no execute bit in order to overcome vulnerabilities that could be used to execute malicious code? for example, is it implemented in Win7? Does that mean that the ...
- 259
1
vote
1
answer
1k
views
Determining the target address in a heap overflow
For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step :
hdr->next->next->prev = hdr->next->prev
I understand that the address of hdr-&...
- 4,360