Double free bugs details?

[ammo]

Does anyone have an explanation as to how a double free bug becomes a security vulnerability? I mean, asside than "a double free is when you free() a pointer twice..."

IE:
How does free() behave when double freeing?
What makes it possible to execute arbitrary code when exploiting a double free?


Ammo

[bigb]

Gotcha a good article from Security Focus This is a published exploit.

Also, CERT Lays down some good basics on the subject.

[ammo]

Thanks bigb!
I had already found the cert article and found it relatively un-helpful but the security focus post is gold! Gotta admit this is some deep stuff! I can't start to think as to how these people figure out / think of such bugs and exploit!


Ammo

[bigb]

Yeah, it's gotta take some serious dedication and time. A real hardcore type.