netvar1337 Use-after-free (UAF)
Root patterns
- Explicit free/delete then use
- Callback after teardown
- Iterator into cleared container
- Refcount underflow → premature destroy (
integer-overflowunderflow)
Exploit path
- Stabilize free trigger
- Identify dangling object type/size
- Spray same-size controlled allocations
- Corrupt virtual function table / function ptr / length+buffer
- Call path that trusts dangling object
C++ tips
- vptr first qword/qword on MSVC/Itanium layouts — confirm
- Fake vtable in controlled spray; ensure RX or pivot to stack ROP if DEP
Kernel pool UAF (high level)
- Pool backend/lookaside differences
- Quota/process context
- Prefer data-only (token) when SMEP/SMAP/CIG
Pair with
heap-exploitation, kernel-dev, c-review.