Linux Heap Exploitation Intro Series: Riding free on the heap – Double free attacks!

This blog post explains double-free heap vulnerabilities in user-space glibc allocators and demonstrates multiple proofs-of-concept using normal and fastbins to leak allocator metadata (including main_arena->top), bypass ASLR, and overwrite __malloc_hook to obtain arbitrary code execution, with gdb walkthroughs and code snippets.