Schrödinger's Chunk: Is It Freed?
Yes. Is It Allocated? Also Yes.
Do We Have a Shell? Absolutely.

A single null byte. No use-after-free in the target. No double-free. Every mitigation the toolchain offers — Full RELRO, stack canary, NX, PIE — all active. That is the starting position.

This post documents a heap exploitation technique we are calling Schrödinger's Chunk. The name captures the core primitive: a chunk that exists simultaneously in two states, allocated from the program's perspective, freed from the allocator's perspective. We manufacture this condition from nothing by chaining five bugs in glibc 2.43's own allocator code. The target program is correct. The bugs are in glibc.

The canonical entry point is a null byte overflow. But Schrödinger's Chunk is not tied to one primitive. Any corruption that creates overlapping chunk views — including uncontrolled out-of-bounds writes, weak single-byte overwrites, or partial size corruptions — can serve as the entry point.

glibc 2.43: What Changed and Why It Matters

Several changes in this release shifted the attack surface in ways that are not immediately obvious.

Fastbins Removed

glibc 2.43 removed fastbins entirely. Everything small now flows through either the tcache (fast path) or the full consolidation machinery (_int_free_merge_chunk). Any bug in the tcache now affects a much larger fraction of all program allocations.

Tcache Expanded to 76 Bins

The tcache grew from 64 size classes to 76: 64 small bins plus 12 large bins. TCACHE_MAX_BINS = 76. The tcache_perthread_struct now holds uint16_t num_slots[76] (152 bytes) and tcache_entry *entries[76] (608 bytes), totaling 760 bytes.

Lazy Tcache Initialization

This is the structurally important change. In glibc 2.35 the struct was allocated during the first malloc(). In glibc 2.43 it is allocated lazily, during the first free(). The heap layout consequence is fully deterministic — given any heap address leak, the address of every subsequent allocation is computable by arithmetic.

if (__glibc_unlikely (tcache_inactive ()))
    return tcache_free_init (mem);

Early init (glibc 2.35):
  first malloc() → allocate tcache struct → allocate requested chunk

Lazy init (glibc 2.43):
  malloc() #1 → allocate chunk directly (no tcache yet)
  free() #1  → allocate tcache struct via tcache_free_init → re-free chunk

Resulting layout:
  heap_base + 0x000:  first malloc chunk   (e.g. 0x20 for malloc(1))
  heap_base + 0x020:  tcache_perthread     (0x310)
  heap_base + 0x330:  second malloc chunk

Relaxed Tcache Free Path

In __libc_free, when a freed chunk is tcache-eligible, glibc 2.43 takes an early return directly to tcache_put after only two checks. The check_inuse_chunk call from prior versions is gone. The size field is accepted as-is as long as it falls within a valid tcache bin range. This is how size-field corruption becomes exploitable here.

The Allocator's Bookkeeping

     chunk_ptr
      │
      ▼
  ┌───────────────────┐  ← chunk header
  │  prev_size  (8B)  │  only valid when prev chunk is free
  ├───────────────────┤
  │  size       (8B)  │  total chunk size | flags in low 3 bits
  ├───────────────────┤  ← user pointer (what malloc returns)
  │                   │
  │   user data       │
  │                   │
  └───────────────────┘

Bit 0 of size is PREV_INUSE. When it is 0, prev_size is valid and tells the allocator how far back to walk. Safe-linking since glibc 2.32 encodes next pointers via PROTECT_PTR(pos, ptr) = (pos >> 12) ^ ptr. The key requires knowing the storage address — or so the design intends.

Five Bugs in glibc 2.43

Entry Points: What Primitive Does This Actually Need

Schrödinger's Chunk requires one thing: an overlapping chunk. One live program-visible handle and one allocator-visible free chunk referencing the same physical memory. Once you have that, the rest runs from glibc's own bugs.

Path A: Null Byte Overflow (Canonical)

The null byte at buf[n] lands on byte 0 of the adjacent chunk's size field, clearing PREV_INUSE. When that adjacent chunk is freed, the allocator walks backward by prev_size bytes, finds a fake free chunk we constructed in our live buffer, passes the self-pointing unlink check, and merges. The merged chunk enters the unsorted bin — but our live handle still covers that memory.

Before:
  ┌──────────────────┬──────────────────┐
  │  [prev]  0x510   │  [victim] 0x500  │
  │  in use          │  PREV_INUSE=1    │
  └──────────────────┴──────────────────┘

After null byte at offset 0x508 (clears victim's PREV_INUSE):
  ┌──────────────────┬──────────────────┐
  │  [prev]  0x510   │  [victim] 0x500  │
  │  in use          │  PREV_INUSE=0 ←  │
  └──────────────────┴──────────────────┘

After free(victim) → _int_free_merge_chunk runs:
  ┌────────────────────────────────────────────────────┐
  │  [merged]  0xA00   in unsorted bin                 │
  │  prev handle still valid → OVERLAP ACHIEVED        │
  └────────────────────────────────────────────────────┘

The Exploit Chain, Phase by Phase

heap_base + 0x000:  [taste]   0x20   ← first malloc() before tcache exists
heap_base + 0x020:  [tcache]  0x310  ← allocated by tcache_free_init on first free()
heap_base + 0x330:  [prev]    0x510  ← source of null byte overflow (0x508 usable bytes)
heap_base + 0x840:  [victim]  0x500  ← consolidation target
heap_base + 0xD40:  [barrier] 0x90   ← prevents top-chunk merge when victim is freed

FSOP to Shell

Full RELRO eliminates GOT overwrites. The target is stdout's _IO_FILE structure. The regular vtable pointer at +0xd8 is range-validated since glibc 2.24. However, the wide character vtable _wide_data->_wide_vtable has no range check. It dispatches to __doallocate (at +0x68 in _IO_jump_t) when the wide character buffer needs initialization. No validation ever touches it.

printf("prompt")
     │
     ▼  stdout->vtable = _IO_wfile_jumps  (legitimate — passes range check)
     │
     ▼  _IO_wfile_xsputn → _IO_wfile_overflow
     │    (wide buffer is NULL, needs allocation)
     │
     ▼  _IO_wdoallocbuf
     │
     ▼  fp->_wide_data->_wide_vtable->__doallocate(fp)
     │       ▲ NOT range-checked
     │
     ▼  our controlled function pointer
     │
     ▼  shell

off-by-one null byte
     │
     ▼  fake chunk (fd=bk=self, size=0x501) — all integrity checks satisfied
     ▼  PREV_INUSE cleared on victim
        _int_free_merge_chunk: backward consolidation
        merged chunk 0xA00 at prev_user → unsorted bin
     │
     ▼  overlap: prev handle over free merged chunk
        read unsorted bin fd → libc base
     │
     ▼  carve E from overlap, free to tcache
        Bug 4 (lazy init): E_user computable → safe_key known
        write PROTECT_PTR(E,E) to E->next through overlap
        Bug 1 (no cycle detection): tcache[0x90] = E→E→E→...
     │
     ▼  double pop: A=E_user, B=E_user
        Bug 2 (no count bound): num_slots = 8, exceeds max
     │
     ▼  free(A): re-free E_user
        Bug 3 (key clearing bypasses gate): verify skipped
        Bug 2 (inflated count): tcache_put accepted
        write(B): UAF write to freed tcache metadata
     │
     ▼  tcache poison: E->next → tracking_table
        two pops → arbitrary allocation at tracking_table
     │
     ▼  arbitrary R/W via tracking_table overlay
     │
     ▼  FSOP: corrupt stdout (_flags, _lock, _wide_data, vtable)
        fake _IO_wide_data → fake _wide_vtable
        __doallocate (+0x68) → win()
     │
     ▼  shell

What Makes This Different