Dude, where’s my heap?
Summary: Google Project Zero's Ivan Fratric published a proof-of-concept showing that a timing attack on Internet Explorer's MemoryProtector mitigation can reveal the offset used by High Entropy Bottom-Up Randomization, which introduces 1TB of variance in heap start addresses in 64-bit Windows 8 processes. The PoC sprays the stack with double-precision numbers that look like addresses, triggers MemoryProtector's stack scan, and measures free times with performance.now() to detect the allocation range, testing 0x4000 possibilities per experiment across 16K experiments in about 30 seconds.
Key Takeaway: Two mitigations Microsoft treated as unrelated - MemoryProtector and High Entropy Bottom-Up Randomization - turned out to defeat each other, and the bypass was reported to Microsoft on January 19th under the Mitigation Bypass Bounty program, which acknowledged it had 'novel elements' before the investigation concluded roughly three months later.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026