This book on heap exploitation is a guide to understanding the internals of glibc’s heap and various attacks possible on the heap structure.
https://github.com/DhavalKapil/heap-exploitation
https://heap-exploitation.dhavalkapil.com/
Tag: GlibC
Intel releases GLibC advisory
The Intel Software Center has announced a list of multiple products and services implacted by the recent GLibC bug:
Intel ID: INTEL-SA-00049
CVE Name: CVE-2015-7547
Intel Software Products and Services that rely on glibc may be indirectly impacted by CVE-2015-7547. Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) prior to version 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo. Intel Products and API services not included in this advisory are considered not to be impacted at this time. Intel Products and API services listed below are potentially impacted indirectly by this issue since those perform DNS lookups and are reliant on the Operating System. End-users should contact their Operating System vendor for a relevant glibc patch to help mitigate CVE-2015-7547. Intel recommends customers contact their Operating System vendor for a relevant glibc patch to help mitigate CVE-2015-7547. […]
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
https://access.redhat.com/articles/2161461
Full advisory:
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00049&languageid=en-fr
GNU/GlibC vulnerable to network traffic
https://github.com/fjserna/CVE-2015-7547
https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
https://twitter.com/martin_prpic/status/699633897500442624
https://access.redhat.com/articles/2161461
https://twitter.com/msolnik/status/699646671659995136
This is why IoT devices need the ability to have software updates.
Bypassing ALSR on GLibC (at build time)
Rich Felker notes that Glibc — the GNU C standard library implementation — usage and how it impacts ASLR security:
[PATCH] Add Prefer_MAP_32BIT_EXEC for Silvermont
https://sourceware.org/ml/libc-alpha/2015-12/msg00221.html
Firmware Security 