Printable View
Does anyone have an explanation as to how a double free bug becomes a security vulnerability? I mean, asside than "a double free is when you free() a pointer twice..." :rolleyes:
IE:
How does free() behave when double freeing?
What makes it possible to execute arbitrary code when exploiting a double free?
Ammo
Gotcha a good article from Security Focus This is a published exploit.
Also, CERT Lays down some good basics on the subject.
Thanks bigb!
I had already found the cert article and found it relatively un-helpful but the security focus post is gold! ;) Gotta admit this is some deep stuff! I can't start to think as to how these people figure out / think of such bugs and exploit!
Ammo
Yeah, it's gotta take some serious dedication and time. A real hardcore type.