Largebin insertion yields a constrained write

Allocator metadata is active data: normal allocation operations read and write it. A corruption can therefore borrow the allocator’s next bookkeeping store, but that store often supplies only a constrained value at an attacker-selected destination.

Research anchor and scope

how2heap’s glibc 2.35 largebin demonstration revisits insertion after checks introduced in glibc 2.30. It chooses the smaller-than-smallest insertion path with two differently sized chunks in the same largebin. A corrupted bk_nextsize redirects a metadata store, which writes the inserted chunk’s address. It demonstrates a selected destination, not an arbitrary chosen 64-bit value. No source code is copied or executed in this brief.

Model the allocator transition

Write a ledger of each chunk’s address, physical neighbors, size, allocation status, and logical bin. An unsorted-bin entry does not become a largebin entry until a later allocation drives the relevant sorting path. The allocation that triggers insertion matters as much as the corrupted field.

For a toy ordered list, inserting node V may perform previous.link = V. If an attacker changes where previous points, the list operation writes V’s address to a chosen location. The value is predetermined by the new node, while the address may be controllable. This can alter a pointer-bearing target but is unsuitable for a target requiring a precise nonpointer scalar unless another conversion exists.

Preserve size and integrity conditions

Inspect the target libc’s implementation around every store and guard. Size ordering can select a different branch with different consistency checks. Two chunks that look close in size may fall into different bins after allocator alignment and metadata rounding. Guard allocations can prevent physical coalescing; without them, the expected free objects may merge and disappear.

Identify the corruptible field and its access precondition, such as a use-after-free or overflow into a freed chunk. Record which linked-list neighbors must remain legitimate. Corrupting all metadata indiscriminately often reaches a guard before the desired store. Derive the target offset from the field being assigned on the tested architecture rather than memorizing a magic subtraction.

Use the primitive honestly

Demonstrate a benign pointer-sized target and compare its final value with the expected inserted chunk address. Keep this separate from any later allocator or I/O target. ASLR, safe-linking on other bin types, pointer validation, and removed hooks can change the usefulness of the resulting value even when the largebin store remains reachable.

A directory labeled glibc_2.35 establishes the example’s intended variant, not a promise across every downstream 2.35 patch set. Reproduce with the supplied libc and loader or inspect their exact source. A constrained allocator write becomes a complete exploit only after a compatible target and subsequent use are established.