I read an article about the Execute Disable Bit (EDB) on x86 CPUs. This is more widely known as the NX bit; Intel also calls it XD.

So Windows XP supports this hardware feature. Yay! But how do I know if my Linux distribution of choice supports it?

What problems can occur, if this BIOS option is enabled?

Where do I read more on how this feature is handled by Linux?

  • Your question is unkown, please explain more. – PersianGulf Sep 18 '13 at 8:18
  • It was deperecated! use new article and new distro...! – PersianGulf Sep 18 '13 at 8:26

how do I know if my distro of choice supports it?

It's been in the kernel since 2004, so one way or another they all do. When you are looking around, avoid old articles which focus on RedHat as they apparently had a patch for this about a year earlier.

  • So I should keep this ON in the BIOS. And turn it OFF only if I decide to run an ancient OS? – Vorac Sep 18 '13 at 8:22
  • @Vorac: Yes, keep it enabled. – jofel Sep 18 '13 at 8:58

This feature is generically known as the NX bit. It is a flag on a memory page in the MMU that marks the page as not being executable: if some code jumps into that page, a segmentation fault (in unix terms) occurs.

A common hygiene measure where supported is to mark writable pages as read-only, because code is usually not modifiable. This cannot be done in all situations, for example it prevents just-in-time compilation. The benefit is to prevent certain bugs from that cause the program to jump into a memory area that contains data, which is especially bad when that data is supplied by the user as it allows the user to inject code and exploit the program. Thus the NX bit causes some exploits against security vulnerabilities to stop working. However, as a security measure, it is not a panacea: there are techniques to work around it, such as return-oriented programming. The main usefulness of NX is to more easily detect bugs.

Note that the article you cite is somewhat misleading. NX prevents many pre-existing exploits from working, but exploits and viruses have adapted to the times. Another error in that article is that NX is not a feature of the BIOS, it is a feature of the CPU (which some BIOSes can disable; I don't know of any benefit of disabling it).

The Wikipedia page has a detailed rundown on which unix variants provide some support for NX. Applications can control whether a page is executable by calling the mmap system call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.