3 ms·
CPU support is required. https://en.wikipedia.org/wiki/NX_bit https://en.wikipedia.org/wiki/NX_bit
by vardump 10y ago
CPU support is required.
https://en.wikipedia.org/wiki/NX_bit https://en.wikipedia.org/wiki/NX_bit
- symtos 10y agonot necessarily. there are software emulation -- examples would be W^X on OpenBSD[1] and Grsecurity/PaX on linux[2]. Ubuntu[3] and RedHat[4] also has (partial) NX-emulation thanks to ExecShield. As for OpenBSD and Linux without grsec/pax, one can bypass NX (whether the CPU has the NX-bit or not) by marking the region with the shellcode as executable, eg: mprotect(shellcode & -pagesize, len, PROT_EXEC); ((void()()) shellcode)(); in an exploit this could be accomplished by ROPing 1: http://marc.info/?l=openbsd-misc&m=105056000801065 http://marc.info/?l=openbsd-misc&m=105056000801065 2: https://pax.grsecurity.net/docs/mprotect.txt https://pax.grsecurity.net/docs/mprotect.txt 3: https://outflux.net/blog/archives/2009/05/14/nx-emulation-in-ubuntu/ https://outflux.net/blog/archives/2009/05/14/nx-emulation-in... 4: https://en.wikipedia.org/wiki/Exec_Shield https://en.wikipedia.org/wiki/Exec_Shield
- cyphar 10y agoRight, but it doesn't change my statement that W^X is enforced by the kernel (meaning the kernel sets all of the program pages to have the right bitset). Not to mention that it was (is?) emulated in software for some kernels.