Thank you for taking the HeapLAB Part 1 course.
I hope that you enjoyed it and that you learned something.
We've seen that heap implementations can suffer from a variety of bug classes, not just overflows
but double-frees and use-after-frees too. And even subtle bugs like a single byte overflow can lead
to code execution.
Don't hesitate to get out there and start searching for heap-related bugs,
they can manifest in unexpected ways.
For example, the realloc() function that we haven't covered in this course is an amalgamation of the
free() and malloc() functions, used to resize chunks.
And you can pass it an existing chunk, followed by the new size you want it to be
and programmers may be unaware that passing a size value of zero to realloc() is often an implicit
free() operation.
This can lead to double-frees, which is exactly what happened in an Android gif parsing library last
year.
What's more, heap bugs can be difficult to detect.
We've seen that even when malloc's inline metadata has been corrupted
the heap can remain stable for quite some time.
The GLIBC heap implementation does have a debugging mode, which makes finding bugs much easier,
but again, many programmers may not be aware of its existence.
So if there are lots of ways in which a heap can be corrupted and they're difficult to detect, it stands
to reason that there are plenty of undiscovered heap-related bugs out there waiting to be found.
And just because we learned about the GLIBC heap during this course, that doesn't mean you can't
apply what you've learned to other implementations.
The reason I teach GLIBC heap exploitation specifically is because it's one of, if not the most
protected Linux heap implementation.
Others, like
jemalloc, which is used in Android devices, often don't have so much as a double-free mitigation.
So your knowledge is transferable.
At time of recording, HeapLAB Part 2 is under construction and covers some of the more recent
techniques, including the Tcache Dup, the House of Rabbit and the House of Corrosion.
Lastly, if you have time, please leave a review, it really helps.
Now go exploit some heap bugs.