Add the house of mud attack

[fern89]

I have come up with a new house which is similar to house of botcake, also aiming to bypass the restriction preventing naive tcache dup introduced in https://sourceware.org/git/?p=glibc.git;a=commit;h=bcdaad21d4635931d1bd3b54a7894276925d081d.

Instead of unsorted bin used in botcake, this technique uses of fastbin reversal into the tcache to bypass double free protections, and allocate a chunk at an arbitrary address that is 0x10 aligned. I have tested it on all versions from 2.34 to 2.42, both inclusive, on x86_64 architectures, but the code allowing it to work is present as far back as 2.26, at https://elixir.bootlin.com/glibc/glibc-2.26/source/malloc/malloc.c#L3644.

This aims to serve as a complement to house of botcake, with the added advantage of not requiring differing allocation sizes, which makes it ideal for some more restrictive challenges.

I have also wrote up a simple blog post at https://fern89.github.io/2025/09/20/doublefree/.

[Kyle-Kyle]

Hi, thanks for the contribution.
If I understand the technique correctly, the goal is to add a chunk to tcache and fastbin so that we can take it out twice. And then we use tcache poisoning to hijack the allocation to arbitrary location (in this PoC, the stack).
But it feels like this is essentially fastbin_dup + tcache_poisoning

Please correct me if this understanding is incorrect.

[Kyle-Kyle]

So it is more like,

1. add a chunk ptr to both tcache and fastbin.
2. take ptr out from tcache
3. reverse fastbin into tcache so that ptr becomes a dangling pointer to tcache
4. tcache_poisoning.

It still feels like fastbin_dup + tcache_poisoning to me.

[fern89]

Yes, your understanding of it is correct. But currently, there does not exist any technique that can perform arbitrary allocs (without the limitation of valid size that fastbin dup has) under such restrictions (which is the point of this technique). The end goal is the same as botcake, to make tcache dup work again, but it can act as a good complement in the sense that we can attack chunks with size too small to avoid fastbin as well.