Tag
This blog post explains the current double free detection mechanism in glibc malloc's per-thread tcache, identifies a flaw that allows cross-thread double frees, and proposes a potential fix using randomized keys per thread.