Exploit › Module 2 › Lesson 2
UAF Named
Use-after-free names dereferencing freed memory — recognize lifetime bugs on $PWN_LAB; defenders use smart pointers, sanitizers, and alloc discipline.
Visual · pwn_uaf_named
UAF class literacy. $PWN_LAB only. Original Cyberlium.
Opening
Use-after-free is a lifetime mistake — free then touch — and it belongs in every developer's threat model.
After free(ptr), the pointer must be treated as invalid. UAF occurs when code reads or writes through ptr anyway — the allocator may reuse the slot for unrelated data, producing crashes or logic corruption. Double-free is a related allocator misuse class. Cyberlium names UAF on YOUR toy C at $PWN_LAB with deliberate free-then-use demos observed under gdb/ASan — not heap grooming recipes for remote control. Next: Format String Named.
1. UAF mechanics (named, no exploit recipe)
Allocate, free, then use — the memory may appear in a cache list or be reallocated for another object. Reads leak stale bytes; writes corrupt the new occupant.
On $PWN_LAB, compile a toy that prints after free under ASan — note the error class name and line; do not tune for reliable takeover.
Command guide
Try these commands — UAF mechanics (named, no exploit recipe)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CWE-416 — https://cwe.mitre.org/data/definitions/416.html (use after free named) CWE-415 — https://cwe.mitre.org/data/definitions/415.html (double free named) NVD — https://nvd.nist.gov/vuln/search (UAF CVE literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential sudo apt install curl
macOS:
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL or MinGW Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
cat > "$LAB_PWN/src/uaf_named.c" <<'EOF'
/* Literacy: UAF pattern named — compile/run in controlled lab only */
#include <stdio.h>
#include <stdlib.h>
int main(void) {
char *p = malloc(16);
if (!p) return 1;
snprintf(p, 16, "lab-toy");
free(p);
/* BUG: use-after-free — observe with sanitizer later, not weaponize */
puts(p);
return 0;
}
EOFCommand — copy this
gcc -Wall -O0 -g -o "$LAB_PWN/bin/uaf_named" "$LAB_PWN/src/uaf_named.c" curl -sS 'https://nvd.nist.gov/vuln/search/results?query=use%20after%20free' | head -8 echo 'UAF literacy: CWE-416 — observe bug class, do NOT develop exploit'
Primary tools to practice this lesson: gcc, curl. Reference sites: CWE-416 (https://cwe.mitre.org/data/definitions/416.html); CWE-415 (https://cwe.mitre.org/data/definitions/415.html); NVD (https://nvd.nist.gov/vuln/search). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Where UAF appears in real code
Manual C++ delete/new misuse, C callbacks holding raw pointers, error paths that free early, concurrent free/use without locking. Modern C++ favors RAII; Rust ownership rules prevent many UAF at compile time.
Browser and kernel CVE histories include UAF — defenders prioritize patch velocity and sandboxing.
3. Defender mitigations
AddressSanitizer (ASan) catches many UAF at runtime during testing. Heap quarantine and allocator hardening raise exploitation cost on some platforms — literacy: layered defenses, not silver bullets.
Ship: UAF card — definition, double-free note, ASan one-liner, one $PWN_LAB ASan report sentence. Next: Format String Named.
4. What you ship: UAF class card for $PWN_LAB
UAF definition, double-free note, ASan role. Toy ASan output quoted — no heap exploit recipe. chmod 600.
5. What you record before the next lesson
Date. UAF class card. $PWN_LAB named. File t24-m02-l02-uaf-named.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Build heap grooming steps for remote UAF. Disable ASan to 'practice exploitation.'
Right
Write UAF class card with ASan observation from YOUR toy. Next: Format String Named.
Mission: name UAF on YOUR toy
1) Define UAF in one sentence. 2) Contrast with double-free in one line. 3) Note how ASan helps testers. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
ASan stack traces teach UAF faster than exploit forums.
Knowledge Check
APPLY: Use-after-free literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: After free(ptr), ptr must not be dereferenced.
True or False
Knowledge Check
APPLY: AddressSanitizer primarily helps during:
Multiple choice