Heap Overflows

1
Heap Overflows
2
What is a Heap?

• malloc(), free(), realloc()
• Stores global variables
• Automatic memory allocation/deallocation
• Allocated at runtime
• Implemented in glibc

3
What is a Heap?
4
What is a Heap?
5
Basic Heap Overflows

• /notvuln.c/
• int main( int argc, char argv)
• char buf
• buf (char)malloc(1024)
• printf(bufp, buf)
• strcpy(buf, argv1)
• free(buf)

6
Basic Heap Overflows

• /basicheap.c/
• int main( int argc, char argv)
• char buf
• char buf2
• buf (char)malloc(1024)
• buf2 (char)malloc(1024)
• printf(bufp buf2p\n, buf, buf2)
• strcpy(buf, argv1)
• free(buf2)

7
Basic Heap Overflows

• pegleg_at_localhost lstrace ./basicheap perl e
  print A x 5000
• malloc(1024) 0x080495b0
• malloc(1024) 0x080499b8
• strcpy(0x080495b0, AAAAAAAAAAAAAAAAAAAA)
  0x080495b0
• free(0x080499b8) ltvoidgt
• --- SIGSEGV (Segmentation fault) ---
• killed by SIGSEGV
• Heap Overflow!

8
Heap Overflows

• Overwrite the next chunk header

9
Heap Overflows

• Trace the behavior of free() using gdb
• buf0x80495b0
• bu20x80499b8
• buf2s boundary tags are overwritten

10
Heap Overflows

• (gdb) run python c print A1024\xff\xff\xff
  \xff\xf0\xff\xff\xff
• Set a breakpoint on _int_free() (called by free)
• Right before free is called, we see
• (gdb) print/x edi
• 10 0xfffffff0
• (gdb) print/x esi
• 11 0x80499b0

11
Heap Overflows

• free() arithmatic
• Address of the previous chunk
• (Current chunk address) - (sizeof(previous
  buffer))
• Since we overwrote the (sizeof(previous buffer)),
  we can control the address of the previous chunk
• free() writes to the address of what it thinks is
  the previous chunk
• After some more free() sillyness, we can
  eventually control where free() writes, and
  redirect program execution to the stack

12
Advanced Heap Overflows

• Can also overflow malloc()
• trickier once again corrupt chunk headers to
  redirect flow of execution
• malloc() uses similar arithmatic to
• Not as easy because of differences in each
  version of glibc

13
Sources

• The Shellcoders Handbook (Jack Koziol)
• http//gee.cs.oswego.edu/dl/html/malloc.html
• http//www.cs.ucsb.edu/jzhou/security/overflow.ht
  ml