malloc: Security implications of tcache

[Moritz Eckert]

Hey,

I was wondering if people are aware of the security implications of the 
tcache structure?

Itis operating in similar fashion to the fastbin free-list, but without 
any security checks at all to detect memory corruptions.
This leads back to unconstrained writes and unconstrained arbitrary 
allocations, similar to the times of dlmalloc.
Eventually, this makes all the security checks introduced before rather 
pointless, as they are bypassed completely by design.

There is no real fix to this problem, apart from disabling the tcache of 
course, so I was wondering what lead to the decision to remove security 
checks in this context?

Thank you,
Moritz