Ingo Molnar [interview] announced the availablity of support for AMD's NX, or "no execute" bit for the x86 architecture. Originally introduced by AMD with their Athlon 64 and Opteron processors and marketed as Enhanced Virus Protection, Ingo notes that support for this new bit was also announced by Intel, Transmeta and VIA. Ingo explains:

"What does this patch do? The pagetable format of current x86 CPUs does not have an 'execute' bit. This means that even if an application maps a memory area without PROT_EXEC, the CPU will still allow code to be executed in this memory. This property is often abused by exploits when they manage to inject hostile code into this memory, for example via a buffer overflow.

"The NX feature changes this and adds a 'dont execute' bit to the PAE pagetable format. But since the flag defaults to zero (for compatibility reasons), all pages are executable by default and the kernel has to be taught to make use of this bit."

From: Ingo Molnar [email blocked]
To:  linux-kernel
Subject: [announce] [patch] NX (No eXecute) support for x86, 2.6.7-rc2-bk2
Date: 	Wed, 2 Jun 2004 22:50:25 +0200


we'd like to announce the availability of the following kernel patch:

     http://redhat.com/~mingo/nx-patches/nx-2.6.7-rc2-bk2-AE

which makes use of the 'NX' x86 feature pioneered in AMD64 CPUs and for
which support has also been announced by Intel. (other x86 CPU vendors,
Transmeta and VIA announced support as well. Windows support for NX has
also been announced by Microsoft, for their next service pack.) The NX
feature is also being marketed as 'Enhanced Virus Protection'. This
patch makes sure Linux has full support for this hardware feature on x86
too.

What does this patch do? The pagetable format of current x86 CPUs does
not have an 'execute' bit. This means that even if an application maps a
memory area without PROT_EXEC, the CPU will still allow code to be
executed in this memory. This property is often abused by exploits when
they manage to inject hostile code into this memory, for example via a
buffer overflow.

The NX feature changes this and adds a 'dont execute' bit to the PAE
pagetable format. But since the flag defaults to zero (for compatibility
reasons), all pages are executable by default and the kernel has to be
taught to make use of this bit.

If the NX feature is supported by the CPU then the patched kernel turns
on NX and it will enforce userspace executability constraints such as a
no-exec stack and no-exec mmap and data areas. This means less chance
for stack overflows and buffer-overflows to cause exploits.

furthermore, the patch also implements 'NX protection' for kernelspace
code: only the kernel code and modules are executable - so even
kernel-space overflows are harder (in some cases, impossible) to
exploit. Here is how kernel code that tries to execute off the stack is 
stopped:

 kernel tried to access NX-protected page - exploit attempt? (uid: 500)
 Unable to handle kernel paging request at virtual address f78d0f40
  printing eip:
 ...

The patch is based on a prototype NX patch written for 2.4 by Intel -
special thanks go to Suresh Siddha and Jun Nakajima @ Intel. The
existing NX support in the 64-bit x86_64 kernels has been written by
Andi Kleen and this patch is modeled after his code.

Arjan van de Ven has also provided lots of feedback and he has
integrated the patch into the Fedora Core 2 kernel. Test rpms are
available for download at:

    http://redhat.com/~arjanv/2.6/RPMS.kernel/

the kernel-2.6.6-1.411 rpms have the NX patch applied.

here's a quickstart to recompile the vanilla kernel from source with the
NX patch:

    http://redhat.com/~mingo/nx-patches/QuickStart-NX.txt

	Ingo



From: Linus Torvalds [email blocked]
Subject: Re: [announce] [patch] NX (No eXecute) support for x86, 2.6.7-rc2-bk2
Date: 	Wed, 2 Jun 2004 14:13:13 -0700 (PDT)



On Wed, 2 Jun 2004, Ingo Molnar wrote:
> 
> If the NX feature is supported by the CPU then the patched kernel turns
> on NX and it will enforce userspace executability constraints such as a
> no-exec stack and no-exec mmap and data areas. This means less chance
> for stack overflows and buffer-overflows to cause exploits.

Just out of interest - how many legacy apps are broken by this? I assume 
it's a non-zero number, but wouldn't mind to be happily surprised.

And do we have some way of on a per-process basis say "avoid NX because
this old version of Oracle/flash/whatever-binary-thing doesn't run with
it"?

		Linus



From: Arjan van de Ven [email blocked]
Subject: Re: [announce] [patch] NX (No eXecute) support for x86, 2.6.7-rc2-bk2
Date: 	Wed, 2 Jun 2004 23:17:14 +0200

On Wed, Jun 02, 2004 at 02:13:13PM -0700, Linus Torvalds wrote:
> 
> 
> On Wed, 2 Jun 2004, Ingo Molnar wrote:
> > 
> > If the NX feature is supported by the CPU then the patched kernel turns
> > on NX and it will enforce userspace executability constraints such as a
> > no-exec stack and no-exec mmap and data areas. This means less chance
> > for stack overflows and buffer-overflows to cause exploits.
> 
> Just out of interest - how many legacy apps are broken by this? I assume 
> it's a non-zero number, but wouldn't mind to be happily surprised.

based on execshield in FC1.. about zero.

> 
> And do we have some way of on a per-process basis say "avoid NX because
> this old version of Oracle/flash/whatever-binary-thing doesn't run with
> it"?

yes those aren't compiled with the PT_GNU_STACK elf flag and run with the
stack executable just fine. GCC will also emit a "make the stack executable"
flag when it emits code that puts stack trampolines up.
That all JustWorks(tm).

• Archive of above thread
• KernelTrap interview with Ingo Molnar