https://kiperz.dev/tags/freelist-poisoning/ Recent content in Freelist Poisoning on kiperZ Hugo -- 0.147.7 en Fri, 21 Aug 2026 00:00:00 +0000 https://kiperz.dev/kernel/sofirium/ Fri, 21 Aug 2026 00:00:00 +0000 https://kiperz.dev/kernel/sofirium/ <p>A character driver that keeps a singly linked list of &ldquo;NFTs&rdquo;. Deleting the collection frees every node and forgets to clear a single pointer, so the whole list stays walkable after the free. That is the entire bug. Getting from there to a root shell took me longer than it should have, because the obvious fake chunk placement poisons the kmalloc-512 freelist, and the technique I wanted to finish with allocates from kmalloc-512 itself.</p>