Skip to main content

50. Heap Exploitation: An Introduction to tcache Attack Techniques

TL;DR: Understanding glibc's tcache gets you halfway through a heap exploit. This article summarizes its structure and attack patterns.

What is tcache?​

The Thread Local Cache, introduced in glibc 2.26. Each thread caches up to seven freed chunks in bins to support fast reallocation. That speed comes with weaker security validation—a gift to exploit developers.

Core structure​

typedef struct tcache_entry {
  struct tcache_entry *next;  // fd pointer
  struct tcache_perthread_struct *key; // double-free detection (2.29+)
} tcache_entry;

The key field defends against double frees, but it can be bypassed if a heap address can be leaked.

Representative attack patterns​

1. tcache poisoning​

Overwrite the fd of a freed chunk to insert an arbitrary address into a tcache bin.

free(A)          → tcache[0x20]: A → NULL
*A = &target     → tcache[0x20]: A → target
malloc(0x18)     → returns A
malloc(0x18)     → returns target ← arbitrary write!

2. tcache dup (double free)​

Before glibc 2.29: no key → the same chunk can be freed twice → follows the same flow as above.

After 2.29: key XOR obfuscation (2.32+). Bypass it by leaking the heap and calculating the XOR value.

3. house of botcake​

Combine the large bin and tcache to achieve a double free while bypassing key validation. This appears frequently in practical CTFs.

Practice environment​

# pwndbg + pwntools
pip install pwntools
gdb-multiarch ./vuln
pwndbg> heap  # visualize the heap
pwndbg> bins  # inspect bin state

The heap exploitation chapter on pwn.college is the most systematic resource.

Defensive perspective​

  • Upgrade glibc: stronger safe-linking and key validation
  • AddressSanitizer (ASAN): runtime detection of UAF and double frees
  • jemalloc / tcmalloc: alternative allocators

Heap exploitation is "the art of deceiving the allocator." Once you understand tcache, attacks against fastbins, unsorted bins, and large bins follow naturally.