Lecture
Heap overflow, heap overrun, or heap smashing is a type of buffer overflow that occurs in the heap data area. Heap overflows are exploited differently from stack-based overflows. Heap memory is allocated dynamically at run time and typically contains program data. Exploitation is performed by corrupting this data in specific ways so that the application overwrites internal structures such as linked list pointers. The canonical heap overflow technique overwrites dynamic memory allocation linkage (such as malloc metadata) and uses the resulting pointer exchange to overwrite a program function pointer.
For example, in older versions of Linux, two buffers located next to each other on the heap could cause the first buffer to overwrite the metadata of the second buffer. By setting the second buffer's in-use bit to zero and setting its length to a small negative value that allows null bytes to be copied, when the program calls free() on the first buffer, it will try to consolidate the two buffers into one. When this happens, the buffer that is supposed to be freed is expected to contain two pointers, FD and BK, in the first 8 bytes of the previously allocated buffer. BK is written to FD and can be used to overwrite a pointer.
void unlink(S, BK, FD){
BK = S->bk;
FD = S->fd;
FD->bk=BK;
FD->fd=FD;
}
Let us look at how mmap works. In the first step, the arrays (bins) of the required sizes (for example, 24 bytes) are checked. If a suitable block exists, it is detached using unlink.
In the second step, if the block is large enough, it is split into two parts. The first part is allocated, and the second is redistributed into another array.
In the third step, if no block of the required size was found, the W-block is checked. If it fits, the procedure from step two is performed on it. If the W-block turns out to be too small, sbrk() and mmap() are used to extend the available memory. The free method is the exact opposite of mmap.
A heap overflow is a type of buffer overflow that occurs in the heap data area. Heap memory is allocated dynamically by the application at run time and typically contains program data. Exploitation is performed by corrupting this data in a particular way so that the application overwrites internal structures such as linked list pointers. The canonical heap overflow technique overwrites the dynamic memory allocation linkage (such as malloc metadata) and uses pointer exchange to overwrite a pointer to a program function.
An accidental overflow may result in data corruption or unexpected behavior in any process that accesses the affected memory area. On operating systems without memory protection, this could be any process on the system.
For example, the Microsoft JPEG GDI+ buffer overflow vulnerability could make remote code execution possible on a vulnerable machine.
Jailbreaking iOS often uses a heap overflow to execute arbitrary code.
As with buffer overflows, there are three main ways to protect against heap overflows. Some modern operating systems, such as Windows and Linux, provide some implementation of all three.
Starting with version 2.3.6, GNU libc includes protections that can detect heap overflows after the fact, for example by checking pointer consistency when unlink is called. However, it was shown almost immediately that these protections against earlier exploits can be circumvented as well. In addition, Linux has supported ASLR since 2005, although PaX introduced a better implementation several years earlier. Linux has also supported the NX bit since 2004.
Microsoft has included protections against heap buffer overflows since April 2003 in Windows Server 2003 and since August 2004 in Windows XP with Service Pack 2. These mitigations were safe unlinking and heap entry header cookies. Later versions of Windows, such as Vista, Server 2008, and Windows 7, include: removal of commonly used data structures, randomization of heap entry metadata, an expanded role for the heap header cookie, a randomized heap base address, function pointer encoding, termination on heap corruption, and algorithm variation. Ordinary Data Execution Prevention (DEP) and ASLR also help mitigate this attack.
Comments