The classic malloc overflow, of overwriting pointers in a free chunk, to cause free() unlink to overwrite an arbitrary location with an arbitrary value, is no longer possible with modern glibc (although, other, more complicated attacks are possible), due to various security checks.
What are these checks, how do they work, and where are they implemented? Do they make the classic unlink technique never work, or are there cases where it does?
References:
