• Ingo Molnar's avatar
    [PATCH] NX (No eXecute) support for x86 · 36bc33ba
    Ingo Molnar authored
    we'd like to announce the availability of the following kernel patch:
    
         http://redhat.com/~mingo/nx-patches/nx-2.6.7-rc2-bk2-AE
    
    which makes use of the 'NX' x86 feature pioneered in AMD64 CPUs and for
    which support has also been announced by Intel. (other x86 CPU vendors,
    Transmeta and VIA announced support as well. Windows support for NX has
    also been announced by Microsoft, for their next service pack.) The NX
    feature is also being marketed as 'Enhanced Virus Protection'. This
    patch makes sure Linux has full support for this hardware feature on x86
    too.
    
    What does this patch do? The pagetable format of current x86 CPUs does
    not have an 'execute' bit. This means that even if an application maps a
    memory area without PROT_EXEC, the CPU will still allow code to be
    executed in this memory. This property is often abused by exploits when
    they manage to inject hostile code into this memory, for example via a
    buffer overflow.
    
    The NX feature changes this and adds a 'dont execute' bit to the PAE
    pagetable format. But since the flag defaults to zero (for compatibility
    reasons), all pages are executable by default and the kernel has to be
    taught to make use of this bit.
    
    If the NX feature is supported by the CPU then the patched kernel turns
    on NX and it will enforce userspace executability constraints such as a
    no-exec stack and no-exec mmap and data areas. This means less chance
    for stack overflows and buffer-overflows to cause exploits.
    
    furthermore, the patch also implements 'NX protection' for kernelspace
    code: only the kernel code and modules are executable - so even
    kernel-space overflows are harder (in some cases, impossible) to
    exploit. Here is how kernel code that tries to execute off the stack is 
    stopped:
    
     kernel tried to access NX-protected page - exploit attempt? (uid: 500)
     Unable to handle kernel paging request at virtual address f78d0f40
      printing eip:
     ...
    
    The patch is based on a prototype NX patch written for 2.4 by Intel -
    special thanks go to Suresh Siddha and Jun Nakajima @ Intel. The
    existing NX support in the 64-bit x86_64 kernels has been written by
    Andi Kleen and this patch is modeled after his code.
    
    Arjan van de Ven has also provided lots of feedback and he has
    integrated the patch into the Fedora Core 2 kernel. Test rpms are
    available for download at:
    
        http://redhat.com/~arjanv/2.6/RPMS.kernel/
    
    the kernel-2.6.6-1.411 rpms have the NX patch applied.
    
    here's a quickstart to recompile the vanilla kernel from source with the
    NX patch:
    
        http://redhat.com/~mingo/nx-patches/QuickStart-NX.txt
    
    update:
    
     - make the heap non-executable on PT_GNU_STACK binaries.
    
     - make all data mmap()s (and the heap) executable on !PT_GNU_STACK
       (legacy) binaries. This has no effect on non-NX CPUs, but should be
       much more compatible on NX CPUs. The only effect it has it has on
       non-NX CPUs is the extra 'x' bit displayed in /proc/PID/maps.
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    36bc33ba
cpufeature.h 5.51 KB