Heap-based Buffer Overflow

Description

Heap-based Buffer Overflow is a buffer overflow vulnerability that occurs in the heap memory region, where dynamically allocated memory resides. When a program writes more data to a heap-allocated buffer than its allocated size, it corrupts adjacent heap structures including other allocated objects, heap metadata (chunk headers, free lists), and control data. Unlike stack overflows where return addresses provide direct control flow hijacking, heap overflows require corrupting heap management structures or function pointers stored in heap objects to achieve code execution.

Risk

Heap overflows are highly dangerous despite being generally harder to exploit than stack overflows. Modern exploitation techniques like heap feng shui, use-after-free chaining, and corrupting C++ vtable pointers make heap overflows reliably exploitable. Heap metadata corruption can enable arbitrary write primitives. Browser engines, document parsers, and multimedia codecs frequently contain heap overflow vulnerabilities that enable remote code execution. The complexity of heap exploitation has spawned sophisticated techniques that bypass protections like ASLR through information disclosure or heap spraying.

Solution

Use memory-safe allocation wrappers that track buffer sizes. Prefer C++ containers (std::vector, std::string) over raw heap allocations. Use AddressSanitizer during development to catch heap overflows. Implement heap hardening: enable glibc heap protections, use hardened allocators (OpenBSD malloc, mimalloc, tcmalloc with hardening). Validate all sizes before heap operations. Use static analysis to find mismatched allocation/copy sizes. Consider Rust or other memory-safe languages for security-critical components.

Common Consequences

Impact	Details
Access Control	Scope: Code Execution Heap metadata corruption enables arbitrary write primitives; vtable/function pointer corruption enables code execution.
Integrity	Scope: Integrity Adjacent heap objects can be corrupted, leading to application logic manipulation.
Availability	Scope: Availability Heap corruption typically causes crashes during subsequent allocations or frees.

Example Code + Solution Code

Vulnerable Code

#include <stdlib.h>
#include <string.h>

// VULNERABLE: Heap buffer overflow
void process_data(char *input, size_t len) {
    char *buffer = malloc(64);  // Heap-allocated buffer

    // No size check - heap overflow if len > 64
    memcpy(buffer, input, len);

    // Adjacent heap chunks corrupted
    process(buffer);
    free(buffer);
}

// VULNERABLE: Integer overflow leading to heap overflow
void parse_packet(unsigned int size, char *data) {
    // Integer overflow: size + 1 wraps to 0
    char *buf = malloc(size + 1);
    memcpy(buf, data, size);  // Massive overflow
    buf[size] = '\0';
}

Fixed Code

#include <stdlib.h>
#include <string.h>
#include <stdint.h>

// SAFE: Size-checked heap allocation
void process_data(const char *input, size_t len) {
    if (len > 1024) {  // Reasonable maximum
        return;
    }

    char *buffer = malloc(len + 1);
    if (!buffer) return;

    memcpy(buffer, input, len);
    buffer[len] = '\0';

    process(buffer);
    free(buffer);
}

// SAFE: Integer overflow protection
void parse_packet(size_t size, const char *data) {
    // Check for integer overflow
    if (size > SIZE_MAX - 1) {
        return;
    }

    char *buf = malloc(size + 1);
    if (!buf) return;

    memcpy(buf, data, size);
    buf[size] = '\0';

    // Use buffer...
    free(buf);
}

---

Exploited in the Wild

Internet Explorer Use-After-Free/Heap Overflow Chain (Microsoft, 2014)

CVE-2014-1776 combined heap overflow and use-after-free in Internet Explorer, exploited by APT groups for targeted attacks before patches were available.

• https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html

Chrome V8 Heap Overflow (Google Chrome, Multiple)

Multiple heap overflow vulnerabilities in Chrome's V8 JavaScript engine have been exploited in the wild, demonstrating the ongoing risk in browser JavaScript engines.

• https://chromereleases.googleblog.com/

---

Tools to test/exploit

• AddressSanitizer — detects heap buffer overflows at runtime during development.

• how2heap — educational repository demonstrating heap exploitation techniques.

• HeapLAB — hands-on heap exploitation training platform.

---

CVE Examples

• CVE-2014-1776 — Internet Explorer use-after-free exploited in targeted attacks.

• CVE-2022-0609 — Chrome use-after-free exploited in the wild.

---

References

1. MITRE. "CWE-122: Heap-based Buffer Overflow." https://cwe.mitre.org/data/definitions/122.html

2. Phrack. "Once upon a free()." http://phrack.org/issues/57/9.html