Dissecting House of Apple 2 on modern glibc
Walkthrough shows House of Apple 2 still hijacks glibc 2.43 file streams through an unchecked wide-character vtable.
The post dissects the existing House of Apple 2 file-stream technique on glibc 2.43, as packaged by Ubuntu 26.04 and Fedora 44. Modern glibc rejects a forged primary _IO_FILE_plus vtable in _IO_vtable_check. The technique uses a valid vtable to reach wide-character stream code, where a secondary vtable is dispatched without range checks, producing an arbitrary call that can become a stack pivot and ROP. It assumes a FILE overwrite plus heap and libc leaks and provides a GDB lab rather than a new variant.
- Confirms House of Apple 2 on glibc 2.43, Ubuntu 26.04 and Fedora 44.
- Forged primary vtables fail _IO_vtable_check before the indirect call.
- Valid vtable reaches unchecked wide-character dispatch for an arbitrary call.
- Requires FILE overwrite plus heap and libc leaks; no new variant.
From the original article
12 min read at jazho76.github.ioThis is a dissection of House of Apple 2, and also a small excuse to put an interesting exploitation path under the magnifying glass in GDB and understand it end to end. It does not introduce a new variation of the technique; it simply answers my curiosity about how House of Apple 2 holds up on recent versions of glibc and whether it remains a viable exploitation path.
By jazho76.github.io via fro · jazho76.github.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.