4 ms·
Last time i looked, the musl library allocator was also exploitable by similar style 'house of' attacks. Maybe its been fixed now. I dont know if you can make
by worthless-trash 3y ago
Last time i looked, the musl library allocator was also exploitable by similar style 'house of' attacks. Maybe its been fixed now. I dont know if you can make a judgement call that musl is better because it has 'less code' when its still open to exploit mechanisms that glibc fixed many moons ago.
- CyberDildonics 3y agothe musl library allocator was also exploitable by similar style 'house of' attacks What are you basing this on? Can you demonstrate how this works?
- worthless-trash 3y agoNot in a HN news comment, I don't have that level of dedication to this because its definitely non trivial. However you can read about them in use against the glibc allocator are here: https://github.com/DhavalKapil/heap-exploitation/blob/master/attacks/house_of_einherjar.md https://github.com/DhavalKapil/heap-exploitation/blob/master... The "house of" attack method are attacks against the allocator, its been a while since I've looked into it, I hope musl have hardened their allocator against this kind of attacks.
- CyberDildonics 3y agoThe link you have here is 'attacking' by directly changing the meta data in C with pointer offsets and doesn't mention musl anywhere.
- worthless-trash 3y agoI did not say that it did. I'm saying that I believe the same kind of attacks work against the musl allocator, or at least I think they did at that time. Musl was not being used by the business I worked in, therefore I had no interest in continuing investigation other than trying to get an understanding of how other implementations dealt with it. I'm sorry for any confusion.
- CyberDildonics 3y agoI believe the same kind of attacks work against the musl allocator Why is this even an attack and why would musl have whatever weakness is claimed here?
- worthless-trash 3y agoGotcha.