From a0c13746890e1214fab4db35a3e8f3b725bc3dfb Mon Sep 17 00:00:00 2001 From: D4R30 Date: Sun, 19 Apr 2026 09:14:30 -0400 Subject: [PATCH 1/3] tcache_perthread_struct will appear AFTER the overflowing chunk --- glibc_2.43/tcache_metadata_hijacking.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/glibc_2.43/tcache_metadata_hijacking.c b/glibc_2.43/tcache_metadata_hijacking.c index 15924e2..a62f4bb 100644 --- a/glibc_2.43/tcache_metadata_hijacking.c +++ b/glibc_2.43/tcache_metadata_hijacking.c @@ -24,7 +24,7 @@ int main() printf("first, allocate a large chunk at the top of the heap: %p\n", chunk); void *p1 = malloc(0x10); free(p1); - printf("now, allocate a chunk and free it to initialize tcache_perthread_struct and put it right before our chunk\n"); + printf("now, allocate a chunk and free it to initialize tcache_perthread_struct and put it right after our chunk\n"); printf("the tcache_perthread_struct->tcache_entry[0] should be initialized with %p\n", p1); printf("Now, we simulate an overflow vulnerability to overwrite the pointer\n"); From 17c47127749b3aaa95eb02a7797fb34645a84baa Mon Sep 17 00:00:00 2001 From: D4R30 Date: Sun, 19 Apr 2026 09:29:26 -0400 Subject: [PATCH 2/3] Add notes on using a UAF primitive for tcache_perthread_struct hijack --- glibc_2.43/tcache_metadata_hijacking.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/glibc_2.43/tcache_metadata_hijacking.c b/glibc_2.43/tcache_metadata_hijacking.c index a62f4bb..d0b8097 100644 --- a/glibc_2.43/tcache_metadata_hijacking.c +++ b/glibc_2.43/tcache_metadata_hijacking.c @@ -10,13 +10,17 @@ int main() // introduction puts("This file demonstrates an interesting feature of glibc-2.42: the `tcache_perthread_struct`"); - puts("may not be at the top of the heap, which makes it easy to turn a heap overflow into arbitrary allocation.\n"); + puts("may not be at the top of the heap, which makes it easy to turn a heap corruption into arbitrary allocation.\n"); puts("In the past, before using the heap, libc will initialize tcache using `MAYBE_INIT_TCACHE`."); puts("But this patch removes the call in the non-tcache path: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=cbfd7988107b27b9ff1d0b57fa2c8f13a932e508"); puts("As a result, we can put many large chunks before tcache_perthread_struct"); puts("and use a heap overflow primitive (or chunk overlapping) to hijack `tcache_perthread_struct`\n"); + + puts("The structure's hijack is also possible through the use of a UAF primitive."); + puts("If you have a UAF on a large free chunk before `tcache_perthread_struct`'s initialization, "); + puts("you can control the split chunk which is the allocated `tcache_perthread_struct`\n"); long target[0x4] __attribute__ ((aligned (0x10))); From eb2c3170fba50c2722e10de84446a0f10026dc68 Mon Sep 17 00:00:00 2001 From: D4R30 Date: Sun, 19 Apr 2026 09:57:42 -0400 Subject: [PATCH 3/3] Update tcache_metadata_hijacking for 2.42 --- glibc_2.42/tcache_metadata_hijacking.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/glibc_2.42/tcache_metadata_hijacking.c b/glibc_2.42/tcache_metadata_hijacking.c index 269bce9..255d569 100644 --- a/glibc_2.42/tcache_metadata_hijacking.c +++ b/glibc_2.42/tcache_metadata_hijacking.c @@ -10,13 +10,17 @@ int main() // introduction puts("This file demonstrates an interesting feature of glibc-2.42: the `tcache_perthread_struct`"); - puts("may not be at the top of the heap, which makes it easy to turn a heap overflow into arbitrary allocation.\n"); + puts("may not be at the top of the heap, which makes it easy to turn a heap corruption into arbitrary allocation.\n"); puts("In the past, before using the heap, libc will initialize tcache using `MAYBE_INIT_TCACHE`."); puts("But this patch removes the call in the non-tcache path: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=cbfd7988107b27b9ff1d0b57fa2c8f13a932e508"); puts("As a result, we can put many large chunks before tcache_perthread_struct"); puts("and use a heap overflow primitive (or chunk overlapping) to hijack `tcache_perthread_struct`\n"); + + puts("The structure's hijack is also possible through the use of a UAF primitive."); + puts("If you have a UAF on a large free chunk before `tcache_perthread_struct`'s initialization, "); + puts("you can control the split chunk which is the allocated `tcache_perthread_struct`\n"); long target[0x4] __attribute__ ((aligned (0x10))); @@ -24,7 +28,7 @@ int main() printf("first, allocate a large chunk at the top of the heap: %p\n", chunk); void *p1 = malloc(0x10); free(p1); - printf("now, allocate a chunk and free it to initialize tcache_perthread_struct and put it right before our chunk\n"); + printf("now, allocate a chunk and free it to initialize tcache_perthread_struct and put it right after our chunk\n"); printf("the tcache_perthread_struct->tcache_entry[0] should be initialized with %p\n", p1); printf("Now, we simulate an overflow vulnerability to overwrite the pointer\n");