Advanced Micro Devices

AMD Virtualization Journal

Subscribe to AMD Virtualization Journal: eMailAlertsEmail Alerts newslettersWeekly Newsletters
Get AMD Virtualization Journal: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


Related Topics: AMD Virtualization Journal

AMD: Article

Red Hat to Deploy "NX" vs Viruses

Red Hat to Deploy "NX" vs Viruses

Transmeta, Intel, and AMD have already started supporting "No eXecute" (NX) technology in their next core revisions, and now comes an announcement from Red Hat that it will be adding NX support to Linux.

Specifically, Red Hat has just announced the availability of the following kernel patch, which makes use of the "NX" x86 feature pioneered in AMD64 CPUs.

Windows support for NX has also been announced by Microsoft, for their next service pack.

The NX feature is also being marketed as "Enhanced Virus Protection" and this patch, says Red Hat, makes sure Linux has full support for this hardware feature on x86 too.

Red Hat engineer Ingo Molnar explains:

What does this patch do? The pagetable format of current x86 CPUs does not have an "execute'" bit. This means that even if an application maps a memory area without PROT_EXEC, the CPU will still allow code to be executed in this memory. This property is often abused by exploits when they manage to inject hostile code into this memory, for example via a buffer overflow.

The NX feature changes this and adds a "don't execute" bit to the PAE pagetable format. But since the flag defaults to zero (for compatibility reasons), all pages are executable by default and the kernel has to be taught to make use of this bit.

If the NX feature is supported by the CPU then the patched kernel turns on NX and it will enforce userspace executability constraints such as a no-exec stack and no-exec mmap and data areas. This means less chance for stack overflows and buffer-overflows to cause exploits.

Furthermore, adds Molnar, the patch also implements "NX protection" for kernelspace code: only the kernel code and modules are executable - so even kernel-space overflows are harder (in some cases, impossible) to exploit.

 

More Stories By Red Hat News Desk

Red Hat News Desk trawls the world's news information sources and brings you timely updates on its flagship Red Hat Enterprise Linux as well as the company's other product lines including database, content, and collaboration management applications; server and embedded operating systems; and software - including its most recent virtualization offerings.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.