[Bug malloc/30881] Double Free in fastbin lead to tcache poisoning

[siddhesh at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30881

--- Comment #6 from Siddhesh Poyarekar <siddhesh at sourceware dot org> ---
(In reply to dltkrgksmf@gachon.ac.kr from comment #3)
> 
> I wonder insufficient double free check of fastbin isn't a vulnerability.

It's not I'm afraid; heap consistency checks and undefined behaviour checks
(that double free checks essentially form part of) are not comprehensive for
performance reasons.  In the code you share, the security flaw (and hence the
vulnerability) is the fact that there's a double free in there, not the fact
that the checks are insufficient.  We'd love to enhance the latter (like
Florian is attempting to do, I'd encourage you too to share ideas you may have
in this area on libc-help or libc-alpha) as long as the performance overhead is
not that significant.

-- 
You are receiving this mail because:
You are on the CC list for the bug.