2 ms·

the musl library allocator was also exploitable by similar style 'house of' attacks What are you basing this on? Can you demonstrate how this works?

• worthless-trash 3y ago
  Not in a HN news comment, I don't have that level of dedication to this because its definitely non trivial. However you can read about them in use against the glibc allocator are here: https://github.com/DhavalKapil/heap-exploitation/blob/master/attacks/house_of_einherjar.md https://github.com/DhavalKapil/heap-exploitation/blob/master... The "house of" attack method are attacks against the allocator, its been a while since I've looked into it, I hope musl have hardened their allocator against this kind of attacks.
  • CyberDildonics 3y ago
    The link you have here is 'attacking' by directly changing the meta data in C with pointer offsets and doesn't mention musl anywhere.
    • worthless-trash 3y ago
      I did not say that it did. I'm saying that I believe the same kind of attacks work against the musl allocator, or at least I think they did at that time. Musl was not being used by the business I worked in, therefore I had no interest in continuing investigation other than trying to get an understanding of how other implementations dealt with it. I'm sorry for any confusion.
      • CyberDildonics 3y ago
        I believe the same kind of attacks work against the musl allocator Why is this even an attack and why would musl have whatever weakness is claimed here?
        • worthless-trash 3y ago
          Gotcha.