Heap Feng Shui.

Deterministic heap-grooming technique introduced by Alexander Sotirov in 2007 that arranges allocations to land vulnerable objects next to attacker-controlled ones. It belongs to the Attacks & Threats category of cybersecurity.

Deterministic heap-grooming technique introduced by Alexander Sotirov in 2007 that arranges allocations to land vulnerable objects next to attacker-controlled ones.

Alexander Sotirov coined Heap Feng Shui at Black Hat Europe 2007. Whereas heap spraying is statistical, feng shui carefully allocates, frees and re-allocates objects in JavaScript to shape the browser heap so that, after triggering a memory corruption, the vulnerable object reliably overlaps with attacker-controlled bytes. By exhausting freelists, exploiting size-class bins, and using long-lived allocations as anchors, exploits achieve deterministic layouts even under ASLR and randomized allocators. The idea generalised to kernel heap grooming (Linux SLUB, Windows pool feng shui) and to JavaScript engine exploitation (V8, SpiderMonkey). Modern mitigations include hardened allocators (PartitionAlloc, scudo), MTE on ARM, GWP-ASan, and isolated heaps for sensitive metadata.

Defences for Heap Feng Shui typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Heap grooming.