Supporto No Execute in Linux

Originariamente inviato da sinadex
purtroppo si parla degli altri 4/5 di cielo, viste le penetrazioni di mercato...
cmq, da più parti leggo allarmi in quanto sarebbe un preludio a palladium e via dicendo, io però non ci credo molrto... qualcuno mi illomina?

Originariamente inviato da sinadex
cmq, da più parti leggo allarmi in quanto sarebbe un preludio a palladium e via dicendo, io però non ci credo molrto... qualcuno mi illomina?

Originariamente inviato da paletta
Maggiori informazioni qui:
http://kerneltrap.org/node/view/324...1cae81200ade070

From: Ingo Molnar [email blocked]
To: linux-kernel
Subject: [announce] [patch] NX (No eXecute) support for x86, 2.6.7-rc2-bk2
Date: Wed, 2 Jun 2004 22:50:25 +0200

[...]
What does this patch do? The pagetable format of current x86 CPUs does
not have an 'execute' bit. This means that even if an application maps a
memory area without PROT_EXEC, the CPU will still allow code to be
executed in this memory. This property is often abused by exploits when
they manage to inject hostile code into this memory, for example via a
buffer overflow.

The NX feature changes this and adds a 'dont execute' bit to the PAE
pagetable format. But since the flag defaults to zero (for compatibility
reasons), all pages are executable by default and the kernel has to be
taught to make use of this bit.

If the NX feature is supported by the CPU then the patched kernel turns
on NX and it will enforce userspace executability constraints such as a
no-exec stack and no-exec mmap and data areas. This means less chance
for stack overflows and buffer-overflows to cause exploits.

furthermore, the patch also implements 'NX protection' for kernelspace
code: only the kernel code and modules are executable - so even
kernel-space overflows are harder (in some cases, impossible) to
exploit. Here is how kernel code that tries to execute off the stack is
stopped:

kernel tried to access NX-protected page - exploit attempt? (uid: 500)
Unable to handle kernel paging request at virtual address f78d0f40
printing eip:
...

Originariamente inviato da ilsensine
Ci sono rimasto di sasso leggendo che sui nostri scaldapizzette ancora non è implementata una cosa così ovvia.

Originariamente inviato da Ikitt_Claw
The NX feature changes this and adds a 'dont execute' bit to the PAE
pagetable format.