> For the complete documentation index, see [llms.txt](https://www.ctfrecipes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ctfrecipes.com/pwn/heap-exploitation/use-after-free.md).

# Use after free

**Use-After-Free (UAF)** is a vulnerability related to incorrect use of dynamic memory. If after freeing a memory location, the program does not clear the pointer to that memory, an attacker can still use this pointer with possibly arbitrary values.

## How it works ? 

As explained [here](/pwn/general-knowledge/operation-of-the-heap/chunk-allocation-and-reallocation.md), when a chunk is freed, it's stored into a bins ( fastbins for shorter chunks, unsorted bins for the others. ) and when the program need a new chunck, it will take if from that bins first depending on the required size. 

Then, if the size is compliant, the allocated bin is the same than the previously freed chunk. 

So, the new pointer has the exact same value as the old pointer and then, if the old pointer isn't clear, it will point with this new value. 

This behavior can easily be highlight by the followed code : 

```c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>


int main(void) {
    char *pointer_1 = (char *)malloc(20);

    strcpy(pointer_1, "value 1");

    printf("pointer 1 : %p, value : %s \n", pointer_1, pointer_1);

    free(pointer_1); // Here the pointer_1 is freed but not clear. 

    char *pointer_2 = (char *)malloc(20);
    strcpy(pointer_2, "value 2");

    printf("pointer 1 : %p, value : %s \n", pointer_1, pointer_1);
    printf("pointer 2 : %p, value : %s \n", pointer_2, pointer_2);

}
```

```bash
$ ./test
pointer 1 : 0x12fe2a0, value : value 1 
pointer 1 : 0x12fe2a0, value : value 2 
pointer 2 : 0x12fe2a0, value : value 2
```

{% hint style="info" %}
Note : `pointer_2` was assigned as the same chunk as `pointer_1` because the `pointer_1` chunk was freed before the `pointer_2` chunk allocation

**Unless `pointer_1` was freed, its value still accessible but it point to the new data declared by `pointer_2`**
{% endhint %}

## Resources

{% embed url="<https://heap-exploitation.dhavalkapil.com/attacks/first_fit>" %}