W^X

W^X ("Write XOR Execute"; spoken as double-u ex-or ex^[1]) is the name of a security feature present in the OpenBSD operating system. It is a memory protection policy whereby every page in a process' address space is either writable or executable, but not both simultaneously (the name comes from the XOR Boolean operator). W^X does not prevent these permissions from being requested by applications, write and executable permissions are not used as a matter of policy. The OpenBSD base system has been modified to comply with it. This alleviates some buffer overflow attacks, including the most common stack-based attack: by ensuring that the stack is not executable, arbitrary code injected into it will not execute but instead cause the program to terminate. W^X first appeared in OpenBSD 3.3, released May 2003. Similar features are available for other operating systems, including the PaX and Exec Shield patches for Linux, and NetBSD 4+'s implementation of PaX.

W^X is relatively simple on processors which support fine-grained page permissions, such as Sun's SPARC and SPARC64, AMD's AMD64, Hewlett-Packard's PA-RISC, and HP's (originally Digital Equipment Corporation's) Alpha; some early Intel 64 processors lacked the NX bit required for W^X, but this appeared in later chips. On processors with more limited features, such as the Intel i386, W^X requires using the CS code segment limit as a "line in the sand," a point in the address space above which execution is not permitted and data is located, and below which it is allowed and executable pages are placed.^[2] On all platforms, linker changes were required to separate code (such as trampolines and other code needed for linker and library runtime functions) and data.

See also

• NX bit
• Data Execution Prevention
• Executable space protection

References

1. ^ OpenBSD 3.3 release notes
2. ^ http://marc.theaimsgroup.com/?l=openb sd-misc&m=105056000801065

External links

• OpenBSD-3.3 announcement, public release of W^X
• Slides from a presentation by OpenBSD lead developer Theo de Raadt covering W^X