Excuse the ads! We need some help to keep our site up.
House of Lore
- House of Lore is an attack that uses the process of reallocating chunks corresponding to small bins and placing chunks into small bins.
The allocator checks if the size requested for memory allocation is in the small bin range.
If the requested size is in the small bin range, the index corresponding to the requested size is found.
- And compare the value of bin[index] with the value stored in bin[index]→bk.
Save the value stored in bin[index]→bk to the "victim".
- And check that this value is zero.
If the value stored in "victim" is not 0, the value stored in victim→bk is stored in "bck".
Then check if the values of bck->fd and "victim" are different.
If they are not the same, the allocator prints an error message ("malloc (): smallbin double linked list corrupted") and terminates the process.
If they are the same, set PREV_INUSE at victi->size.
Then, the value of bck is stored in bin→bk, and the value of bin is stored in bck→fd.
- Check if the arena is the main arena.
If not the main arena, set NON_MAIN_ARENA (0x4) flag in victim → size.
The allocator then calls chunk2mem () to store the address to return(victim + 2 * SIZE_SZ) in *p and return p.
The allocator checks if the size of the chunk falls in the small bin range.
If the chunk is in the small bin range, the index of that chunk is searched.
Store the value bck->fd has in fwd.
To implement a double linked list, we store the value of bck in bk of the chunk and the value of fwd in fd.
- Store the pointer to that chunk in fwd → bk, bck → fd.
House of Lore can create a Fake chunk on Stack and can be implemented if it can overwrite the bk value of the Free chunk.
Write a fake free chunk on the stack and allocate memory for the small bin.
Free this memory to make it free chunks.
When requesting new memory allocation, free chunks are placed in Bins.
Overwrite the Fake chunk's pointer with the Free chunk's bk.
When you ask malloc () to allocate chunks placed in the small bin, the start address of the "Fake chunk" is placed in Bins.
And once again, when requests to malloc() the same amount of memory allocation, it returns a pointer to the area of the fake chunk.
The pointer returned is Stack memory.
What matters in the House of Lore is the structure of fake chunks.
This chunk must have the structure of a free chunk and requires two fake chunks.
- You need to store the pointer to the first fake chunk in bk of the free chunk in the heap, and the pointer to bins [idx] in the fd of the first fake chunk.
- Store a pointer to the first fake chunk in "bk" of the free chunk on the heap.
- Then store a pointer to bins[idx] in "fd" of the first Fake chunk.
The pointer to the second fake chunk is stored in "bk" of the first free chunk.
This structure bypasses the check that the double-linked list of chunks placed in the small bin is broken("bck-> fd! = Victim").
For example, in the following structure, the value of "victim" is 0x7fffffffe230 and the value of "bck→fd" is 0x7fffffffe230, so it passes the verification condition.
- Here is the flow of the House of Lore.
- Create a fake chunk on the stack, create a free chunk, and place it in a small bin.
- And store the pointer to fake chunk in "bk" of the free chunk.
- Request malloc() to allocate memory to reallocate that chunk, the allocator places the fake chunk in a small bin.
- If the attacker once again requests the same size memory allocation, the allocator returns the memory of the fake chunk.
- This code is the same code as the previous example.
- Request allocation of memory of size 128 bytes, 256 bytes.
- After freeing memory of 128byte size, it requests memory allocation.
- Write a fake chunk on the stack and store the pointer to the fake chunk in bk of the free chunk.
- Then request the allocation of two memories of 128 bytes in size.
- Check at 0x40079c how the freed chunks are placed in the small bin.
- Pointers to that chunk are placed in the small bin and the pointers reassigned are checked at 0x40081e, 0x40082f.
- Check at 0x4008ad to see if the memory returned is available.
The program was allocated two memories.
The pointer of the first memory is 0x602010 and the size is 128bytes.
- Freeing that memory makes it a free chunk.
And that chunk is placed in the unsorted bin.
Memory allocation is requested to move chunks placed in an unsorted bin to a small bin.
When memory is allocated, free chunks(0x602000) are placed in bins and bins.
- The program creates a fake chunk at 0x7fffffffe2a0.
- The pointer to the first Fake chunk is 0x7fffffffe2a0, the fd of that chunk is 0x602000, and bk is 0x7fffffffe2c0.
- The pointer of the second fake chunk is 0x7fffffffe2c0, and the fd of that chunk is 0x00007fffffffe2a0.
- Because the value of the "victim" is 0x7fffffffe2a0 and the value of bck→fd is 0x7fffffffe2a0, it passes the verification condition.
- After creating a fake chunk, we request memory allocation to register the chunk's pointer to the small bin.
- When memory is allocated from malloc (), a fake chunk is placed in main_arena.bins.
- The program requests an allocation of 128 bytes of memory to reallocate chunks registered in main_arena.bins .
- The allocator determines that there are chunks available in the small bin, and reallocates the chunks registered in main_arena.bins.
- The pointer to the reallocated chunk(0x7fffffffe2b0) is the area of the fake chunk.
- An attacker could store data in a pointer to the returned fake chunk.
- This means that you can change the flow chart of the program according to the situation.