A heap overflow is a class of memory corruption occurring on the heap. It can potentially be used to exploit the faulty program.

learn more… | top users | synonyms

7
votes
1answer
234 views

How to exactly create a CVE? [duplicate]

I found an heap overflow exploit for a vulnerability in git servers. This lead to lucrative operations on various bug bounty programs (GitHub already promised to put me in their top 10). When it ...
4
votes
3answers
756 views

Are stack & heap overflow exploits no longer effective?

Do all new OSes implement the no execute bit in order to overcome vulnerabilities that could be used to execute malicious code? for example, is it implemented in Win7? Does that mean that the ...
4
votes
1answer
87 views

Why would a heap buffer overflow cause a crash on only some Windows 10 systems?

I have a stl::vector (VS 2010 SP1, x86) out-of-bounds read access attempt that causes a crash on only three Windows 10 systems. It is completely reproducible on those systems, but cannot be ...
4
votes
2answers
495 views

Heap canaries, to protect function pointers in heap objects

I'm wondering if anyone has previously proposed, evaluated, or deployed the following measure to harden systems against heap-based buffer overruns: basically, stack canaries, but applied before ...
4
votes
2answers
349 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
4
votes
0answers
93 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
3
votes
1answer
64 views

How to prevent from memcpy, cause Heap Overlflow?

I'm following Stanford CS155 security lesson's presentation to learn integer overflow. I learned today that memcpy() function may lead to overflow. The presentation says, If I have a code something ...
3
votes
1answer
53 views

How can a modern Windows/Linux system be compromised by a heap overflow in Chrome?

Wikipedia's article on Heap Overflow states: there are primarily three ways to protect against heap overflows. Several modern operating systems such as Windows and Linux provide some ...
2
votes
1answer
377 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
2
votes
0answers
110 views

How to write a PoC of heap-based ROP? [closed]

I want to write a Proof-of-Concept to exploiting any heap-based vulnerability(e.g. heap overflow, use-after-free) where my ROP(return-to-programming, a kind of code-reuse attacks) payload is deployed ...
1
vote
1answer
91 views

Controlling where a program crashes

I'm missing a part of the process for preparing a payload for an overflow exploit. To crash a program using an overflow vulnerability, lets say the heap. How can we control the memory address it ...
1
vote
2answers
626 views

Heap spray against 64-bit processes - possible?

Are heap spray exploits possible, if the process we're attacking is a 64-bit process? Naively, it seems like the 64-bit address makes it difficult to mount a heap spray: to fill all (or a significant ...
1
vote
2answers
156 views

What is the heapspray technique and how to use it as reliably as possible?

Can somebody explain the different steps to produce a heapspray attack (what are the needed vulnerabilities in the targeted software, what are the limitations of such technique, how to proceed, ...) ...
1
vote
1answer
452 views

Determining the target address in a heap overflow

For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step : hdr->next->next->prev = hdr->next->prev I understand that the address of hdr-&...
1
vote
0answers
578 views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
0
votes
3answers
605 views

Drive-by downlad VS buffer and stack overflow attacks

Today malware is mainly spread thanks to vulnerabilities exploited in browsers and their plugins. The attackers use JavaScript to target those vulnerabilities. Two examples of such attacks are drive-...
0
votes
1answer
368 views

Does glibc use canary checking to prevent heap buffer overflow?

Since canary is used by gcc to prevent stack overflow (e.g. -fstack-protector), I am wondering whether glibc uses canary-based approach to defend heap buffer overflow? For example, this paper proposes ...