Advanced malloc exploits

This paper details several techniques that allow more generic and reliable exploitation of processes that provide us with the ability to overwrite an almost arbitrary 4 byte value at any location.
(read more …)

Higher level techniques will be constructed on top of the unlink() basic technique (presented in MaXX’s article [2]) to exploit processes which allow an attacker to corrupt Doug Lea’s malloc (Linux default’s dynamic memory allocator).
Source : phrack.org