HOUSE OF APPLE 2 ON MODERN GLIBC

Summary from the TLDR InfoSec newsletter

This walkthrough breaks down House of Apple 2, a glibc FSOP technique that bypasses the vtable validation added in newer glibc. It points a FILE structure's vtable to legitimate wide-character stream code, which then dispatches to a second vtable that glibc does not range-check. Step by step in GDB, the author turns that unchecked indirect call into an arbitrary call, pivots the stack, and runs a ROP chain to a shell. The technique still works cleanly on glibc 2.43 (Ubuntu 26.04 and Fedora 44). Exact offsets and gadgets vary between builds, but the underlying control-flow trick remains the same.