@zer0mem

Heap overflow bug can potentionaly lead to alter heap in that way, that you can rule on its allocation / deallocation mechanism. Nowdays it is litle bit harder, because you need to fullfill some subset of prerequisities for choosen technique, and it is in more than less case not possible.

This post will describe how to break even LFH trough plugin, custom PoC for IE10 on win8 CP, vulnerable to winXP-8CP backend attack.

This time post will be based on talk by Steven Seeley (Ghost in the allocator) and talk by Chris Valasek & Tarjei Mandt (Windows 8 Heap Internals).

I would like to focus on win8 _HEAP_USERDATA_HEADER structure, and its main perfomance feature – missing validation check per allocation from its block.

Some moths ago, on EUSecWest 2012 (by Frederico Muttis & Anibal Sacco), was presented new technique for heap spraying inside HTML5. Main idea is using its new features :

• WebWorker
• Canvas
• UInt8ClampedArray

– to spray the heap quick and efficient, and in addition manipulating data at byte level!