4 ms·

Does the distinction matter? Is changing W pages into X pages meaningfully safer?

• bpye 4y ago
  Yes. It means that you can’t use a write primitive to simply modify an already executable page.
  • lisper 4y ago
    How does that help?
    • remexre 4y ago
      It means an attacker with an arbitrary-write vuln needs to be able to target a page as the JITted code is being written to it, rather than being able to target any existing page with code in it.
      • Dylan16807 4y ago
        And since javascript is so focused on a single thread, it's easy to make sure it's not even running at the same time your JIT code is doing those writes.
• 0x457 4y ago
  It depends on the kind of vulnerability. Say you have a vulnerability that allows writing to arbitrary pages, then an attacker on RWX system can write malicious code into pages that would get executed. In W^X environment, the attacker needs to find a W page and write to it before it becomes the X page. This isn't a 100% mitigation, but it does make it harder to exploit. JavaScript JIT been source of so many RCE vulnerabilities.