Heap Exploitation: Use-After-Free and Heap Spraying
Understand glibc malloc internals, use-after-free conditions, and heap spray techniques.
Heap Exploitation: Use-After-Free and Heap Spraying is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Heap
The heap is dynamic memory allocated at runtime via malloc()/free()/new/delete. Unlike the stack, heap layout is determined by allocation/deallocation patterns, not the call stack. Heap vulnerabilities are common in browsers, parsers, and network daemons.
Use-After-Free (UAF)
A Use-After-Free vulnerability occurs when a program continues to use a memory region after freeing it. If the freed region is reallocated with attacker-controlled data, the program now operates on attacker data using the stale pointer.
UAF Example
UAF pattern:
// Vulnerable C code:
struct Object *obj = malloc(sizeof(*obj));
free(obj);
// Later, attacker causes a new malloc to fill the freed region
// with their data...
obj->method(); // now calls attacker's function pointer!Heap Feng Shui
Heap feng shui (or heap grooming) is the technique of manipulating the heap allocator to place objects in specific positions, enabling controlled reuse of freed memory. The attacker shapes the heap by triggering allocations and frees in a precise sequence.
Heap Spraying
Heap spraying allocates large amounts of attacker-controlled data (shellcode + NOP sleds) across the heap. With so much of the heap filled, a bad pointer is likely to land in the attacker's data. Often used with UAF or type confusion bugs.
// JavaScript heap spray:
var spray = [];
for(var i = 0; i < 100000; i++) {
spray[i] = unescape("%90%90...shellcode...");
}Double Free
A double free occurs when memory is freed twice. The second free corrupts the heap allocator's metadata (free list pointers), potentially allowing an attacker to control where the next allocation is placed — writing to an arbitrary address.
Heap Buffer Overflow
Like stack overflows, a heap buffer overflow writes past the end of a heap allocation. Unlike stack overflows, the target is typically heap metadata (size, forward/backward pointers) or adjacent allocations containing function pointers or vtable pointers.
Type Confusion
Type confusion occurs when a piece of memory allocated as one type is used as a different type. Common in JavaScript engines and C++ code. If an attacker can control the allocation order, they can make the engine treat attacker data as a trusted object.
ptmalloc and tcmalloc Internals
Understanding the heap allocator helps exploit development. glibc's ptmalloc uses bins (unsorted, small, large) and fast bins. tcache (per-thread cache) is the first allocation source. Exploits often target bin corruption to control future allocation addresses.
Mitigations
Heap exploitation mitigations:
- Heap randomization (part of ASLR) — randomizes heap base
- Safe unlinking — verifies forward/backward pointers before unlinking
- tcache poisoning detection — added in glibc 2.32
- Pointer mangling — encrypts stored pointers in tcache
- Memory-safe languages — Rust eliminates UAF at compile time
Browser Heap Exploits
Most browser 0-days involve heap vulnerabilities in JavaScript engines (V8, SpiderMonkey). Modern browsers layer sandbox escape chains: heap bug in renderer → escape to browser process → OS privilege escalation. Each step requires its own technique.
Quick Check: Heap Exploitation
Which vulnerability allows an attacker to control program execution by using a stale pointer to memory that has already been freed and reallocated with attacker data?
Lesson Recap
Heap vulnerabilities — UAF, double free, heap overflow, type confusion — exploit dynamic memory mismanagement. Use-after-free is the most prevalent modern exploit class. Heap spraying maximizes the chance of landing on attacker data. Mitigations: ASLR, safe unlinking, pointer mangling. Memory-safe languages like Rust eliminate these classes entirely.
Frequently asked questions
Is the “Heap Exploitation: Use-After-Free and Heap Spraying” lesson free?
Yes — the full text of “Heap Exploitation: Use-After-Free and Heap Spraying” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Heap Exploitation: Use-After-Free and Heap Spraying”?
Understand glibc malloc internals, use-after-free conditions, and heap spray techniques. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Heap Exploitation: Use-After-Free and Heap Spraying” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Stack Buffer Overflows
- Return-Oriented Programming (ROP)
- Format String Vulnerabilities
- Heap Exploitation: Use-After-Free and Heap Spraying