oss-security - malloc and heap corruption

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Thu, 12 Jun 2008 17:12:11 +0100 (BST)
From: pandora@...mail.com
To: oss-security@...ts.openwall.com
Subject: malloc and heap corruption

Hi,

(apologies if this is not appropriate content, but secproc seems dead)

I've just read up a bit on heap corruption and malloc implementations, and
found that there's at least one open source malloc (dnmalloc by Yves Younan,
http://www.fort-knox.org/) which claims to be invulnerable against
overflows and double frees (it keeps heap management data in a separate area
protected by guard pages), at performance cempetitive to glibc malloc.

However, it seems nobody has picked up on that (only a prototype, apparently
coded as part of a PhD thesis, has been released two years ago), thus I
wonder what the reason is.

Is the whole idea is somehow flawed? Can one construct heap buffer overflows
that could jump across a guard page without touching it? Would you consider
silent data corruption (dnmalloc only protects the heap management data) as
more ominous than the possibility of executing arbitrary code?

(No, I'm not the dnmalloc author, and I'm not begging for code review
either - I would just like to know whether there is some obvious reason
why it would be stupid to use it in my app instead of the glibc malloc).

Thanks.

- IB

-- 
MacMail - the Webmail service especially for Mac users worldwide
http://www.macmail.com

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.