Tags: heap pwn 2.32 safe-linking uaf
Rating:
8 byte UAF on 2.32 glibc (the libc version that introduced the safe linking protections) with only fastbin ranged sizes. Abuse scanf to trigger malloc_consolidate() and largebin activity on the heap to retrieve both a heap and libc leak. With a heap and libc leak, use the uaf to change the fd following the safe linking protection mechanism to overwrite one of the hook functions to pop a shell.
