0x7000 · Exploitation Techniques
Heap Exploitation: tcache and Use-After-Free
The heap's own metadata is the write primitive. Build a use-after-free, poison the glibc tcache to allocate a chunk over a chosen address, and see why safe-linking and ASan raise the bar.