W^X
E590637
W^X is a memory protection security mechanism that enforces pages to be either writable or executable, but not both, to mitigate exploits such as buffer overflows.
Statements (50)
| Predicate | Object |
|---|---|
| instanceOf |
memory protection mechanism
ⓘ
security feature ⓘ |
| affects |
JIT compiler design
ⓘ
dynamic code generation strategies ⓘ |
| alsoKnownAs |
Write XOR Execute policy
ⓘ
W⊕X ⓘ |
| appliesOn |
code segments
ⓘ
heap memory regions ⓘ stack memory regions ⓘ |
| appliesTo | memory pages ⓘ |
| category |
computer security
ⓘ
operating system security ⓘ |
| constrains | page permissions ⓘ |
| contrastsWith | W+X (writable and executable memory) ⓘ |
| designBy | OpenBSD project NERFINISHED ⓘ |
| enforcedBy |
MMU (Memory Management Unit)
NERFINISHED
ⓘ
operating system kernel ⓘ page table permission bits ⓘ |
| fullName | Write XOR Execute ⓘ |
| hasGoal |
mitigate buffer overflow attacks
ⓘ
mitigate code injection attacks ⓘ mitigate memory corruption exploits ⓘ mitigate return-to-libc style attacks ⓘ reduce arbitrary code execution risk ⓘ |
| hasProperty |
enforces non-overlap of writable and executable memory permissions
ⓘ
prevents memory pages from being both writable and executable simultaneously ⓘ |
| implementedIn |
kernel memory management code
ⓘ
user-space memory allocators and loaders ⓘ |
| implies |
JIT engines must separate code generation and execution phases
ⓘ
self-modifying code must use special mechanisms ⓘ |
| influenced |
adoption of non-executable memory policies in other operating systems
ⓘ
design of modern executable space protections ⓘ |
| introducedBy | OpenBSD NERFINISHED ⓘ |
| introducedInVersion | OpenBSD 3.3 NERFINISHED ⓘ |
| introducedInYear | 2003 ⓘ |
| relatedTo |
ASLR
ⓘ
DEP (Data Execution Prevention) NERFINISHED ⓘ NX bit ⓘ executable space protection ⓘ stack canaries ⓘ |
| requires |
hardware support for page-level execute permissions
ⓘ
operating system support in the virtual memory subsystem ⓘ |
| securityBenefit |
forces attackers to rely on code reuse techniques
ⓘ
limits ability of attackers to execute injected payloads ⓘ |
| securityLimitation |
does not fix underlying software vulnerabilities
ⓘ
does not prevent all return-oriented programming attacks ⓘ |
| typicalConfiguration |
mark code pages executable and non-writable
ⓘ
mark data pages writable and non-executable ⓘ |
| usedIn | OpenBSD NERFINISHED ⓘ |
| usesModel | write-or-execute but not both ⓘ |
Referenced by (1)
Full triples — surface form annotated when it differs from this entity's canonical label.