3 ms·
You don't need to be able to change code to execute arbitrary code --- see return-oriented programming. Besides, NX gives you almost all the same benefits. Res
by quotemstr 11y ago
You don't need to be able to change code to execute arbitrary code --- see return-oriented programming. Besides, NX gives you almost all the same benefits.
Restrictions on code execution strike me more as business controls (and yes, assaults on freedom) than real security measures.
- latiera 11y agoLook at my other response in this thread, ROP isn't trivial these days due to ASLR implementations. Almost always one needs information leak bugs. The presence of a JIT makes things trivially abusable for the attacker and is a big security risk.