Root Cause


My name is Chris Rohlf. I've been a security and software engineer since 2003. Root Cause is a space to post technical articles about computer security, obscure computer science topics, and US national security policy.

April 4th, 2021 - I introduced a new feature to IsoAlloc that can detect uninitialized reads using the userfaultfd syscall. This article covers the technical details of how it works.

March 8th, 2020 - This post describes a new secure memory allocator I wrote that relies on an isolation strategy and other lightweight security checks to detect and mitigate memory safety issues.

November 2nd, 2019 - I explored the value of attacker attribution by collecting data from 45 people in CISO and security leadership roles to understand how it affects their defensive strategies.

July 28th, 2019 - A brief overview of the Map Guard library I published to github and how it uses Intel Memory Protection Keys (MPK) to dynamically mark all code in a process as execute only.

June 15th, 2019 - My review of 'Bytes, Bombs and Spies'. A quick recap of my thoughts on this collection of essays tackling the topic of strategic cyber offense. Originally posted on Dave Aitels CyberSecPolitics blog.

January 1st, 2019 - I wanted to briefly explore cross DSO CFI implementations and whether targeting their fast path 'Shadow' allocations was possible as an exploitation technique (it's not).

April 7th, 2017 - In this article I briefly cover the internals and some weaknesses of OilPan, Google's Garbage Collected heap for Chrome.

January 22, 2016 - In this article I dive into how PartitionAlloc works by first explaining its origins and how some of its basic allocation code paths work. I also introduce some basic hardening measures by randomizing the freelist and adding some basic double free protection.

September 9th, 2015 - In this brief article I explain how I ported the Chrome PDFium library to use the PartitionAlloc heap allocator. This brings the benefits of fine graned memory separation for objects allocated inside the PDFium code.

A quick look at the OpenSSL out of bounds read vulnerability from 2014. The internet went into panic mode and blamed the OpenSSL project for maintaining their own malloc. But this, like most things on the internet, was rooted in false assumptions.

Originally posted in 2010 on my first blog, this article explores how ptmalloc2 in glibc 2.11 attempted to stop the obscure House of Mind heap exploitation technique.

Originally posted in 2010 on my first blog, this article looks at an interesting type confusion vulnerability I discovered in WebKit. This was an extremely flexible vulnerability that allowed for an abitrary length read from an arbitrary address.