W^X

W^X (spoken as "double-u ex-or ex" [http://www.openbsd.org/33.html] ) is the name of a security feature present in the OpenBSD operating system. It is a memory protection policy whereby every page in a process' address space is either writable or executable, but not both simultaneously (the name comes from the "xor" Boolean operator, which has this property). W^X does not prevent these permissions from being requested by applications, write and executable permissions are not used as a matter of policy. The OpenBSD base system has been modified to comply with it. This alleviates some buffer overflow attacks, including the most common stack-based attack: by ensuring that the stack is not executable, arbitrary code injected into it will not execute but instead cause the program to terminate. W^X first appeared in OpenBSD 3.3; similar features are available for other operating systems, including the PaX and Exec Shield patches for Linux, and NetBSD 4+'s implementation of PaX.

W^X is relatively simple on processors which support fine-grained page permissions, such as Sun's SPARC and SPARC64, AMD's AMD64, Hewlett-Packard's PA-RISC, and HP's (originally Digital Equipment Corporation's) Alpha; some early Intel 64 processors lacked the NX bit required for W^X, but this appeared in later chips. On processors with more limited features, such as the Intel i386, W^X requires using the CS code segment limit as a "line in the sand," a point in the address space above which execution is not permitted and data is located, and below which it is allowed and executable pages are placed [http://marc.theaimsgroup.com/?l=openbsd-misc&m=105056000801065] . On all platforms, linker changes were required to separate code (such as trampolines and other code needed for linker and library runtime functions) and data.

See also

*NX bit
*Data Execution Prevention
*Executable space protection

External links

* [http://www.openbsd.org/papers/ven05-deraadt/index.html Slides from a presentation by OpenBSD lead developer Theo de Raadt covering W^X]