UAF Named

Use-after-free names dereferencing freed memory — recognize lifetime bugs on $PWN_LAB; defenders use smart pointers, sanitizers, and alloc discipline.

UAF Named• Audio Walkthrough

00:00/03:34

Visual · pwn_uaf_named

UAF class literacy. $PWN_LAB only. Original Cyberlium.

Use-after-free is a lifetime mistake — free then touch — and it belongs in every developer's threat model.

After free(ptr), the pointer must be treated as invalid. UAF occurs when code reads or writes through ptr anyway — the allocator may reuse the slot for unrelated data, producing crashes or logic corruption. Double-free is a related allocator misuse class. Cyberlium names UAF on YOUR toy C at $PWN_LAB with deliberate free-then-use demos observed under gdb/ASan — not heap grooming recipes for remote control. Next: Format String Named.

1. UAF mechanics (named, no exploit recipe)

Allocate, free, then use — the memory may appear in a cache list or be reallocated for another object. Reads leak stale bytes; writes corrupt the new occupant.

On $PWN_LAB, compile a toy that prints after free under ASan — note the error class name and line; do not tune for reliable takeover.

Command guide

Try these commands — UAF mechanics (named, no exploit recipe)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

CWE-416 — https://cwe.mitre.org/data/definitions/416.html (use after free named) CWE-415 — https://cwe.mitre.org/data/definitions/415.html (double free named) NVD — https://nvd.nist.gov/vuln/search (UAF CVE literacy)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install build-essential
sudo apt install curl

macOS:

Command — copy this

xcode-select --install  # or brew install gcc

Windows: Use WSL or MinGW Built-in (PowerShell: Invoke-WebRequest)

═══ LINUX / macOS ═══

Command — copy this

export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
cat > "$LAB_PWN/src/uaf_named.c" <<'EOF'
/* Literacy: UAF pattern named — compile/run in controlled lab only */
#include <stdio.h>
#include <stdlib.h>
int main(void) {
    char *p = malloc(16);
    if (!p) return 1;
    snprintf(p, 16, "lab-toy");
    free(p);
    /* BUG: use-after-free — observe with sanitizer later, not weaponize */
    puts(p);
    return 0;
}
EOF

Command — copy this

gcc -Wall -O0 -g -o "$LAB_PWN/bin/uaf_named" "$LAB_PWN/src/uaf_named.c"
curl -sS 'https://nvd.nist.gov/vuln/search/results?query=use%20after%20free' | head -8
echo 'UAF literacy: CWE-416 — observe bug class, do NOT develop exploit'

Primary tools to practice this lesson: gcc, curl. Reference sites: CWE-416 (https://cwe.mitre.org/data/definitions/416.html); CWE-415 (https://cwe.mitre.org/data/definitions/415.html); NVD (https://nvd.nist.gov/vuln/search). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Where UAF appears in real code

Manual C++ delete/new misuse, C callbacks holding raw pointers, error paths that free early, concurrent free/use without locking. Modern C++ favors RAII; Rust ownership rules prevent many UAF at compile time.

Browser and kernel CVE histories include UAF — defenders prioritize patch velocity and sandboxing.

3. Defender mitigations

AddressSanitizer (ASan) catches many UAF at runtime during testing. Heap quarantine and allocator hardening raise exploitation cost on some platforms — literacy: layered defenses, not silver bullets.

Ship: UAF card — definition, double-free note, ASan one-liner, one $PWN_LAB ASan report sentence. Next: Format String Named.

4. What you ship: UAF class card for $PWN_LAB

UAF definition, double-free note, ASan role. Toy ASan output quoted — no heap exploit recipe. chmod 600.

5. What you record before the next lesson

Date. UAF class card. $PWN_LAB named. File t24-m02-l02-uaf-named.txt chmod 600.

6. Wrong vs right: weaponized exploits vs memory-safety literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Build heap grooming steps for remote UAF. Disable ASan to 'practice exploitation.'
Right: Write UAF class card with ASan observation from YOUR toy. Next: Format String Named.

Hands-on Exercise