W^X

From Wikipedia, the free encyclopedia

W^X (pronounced "W xor X"[1]) is the name of a security feature present in the OpenBSD operating system. It is a form of memory protection whereby any page in a process' address space may be either writable or executable but never both simultaneously (the name comes from the xor Boolean operator, which has this property). This alleviates some buffer overflow attacks, including the most common stack-based attack: by ensuring that the stack is not executable, arbitrary code injected into it will not execute but instead cause the program to terminate. W^X first appeared in OpenBSD 3.3; similar features are available for other operating systems, including the PaX and Exec Shield patches for Linux.

W^X and similar implementations are relatively simple to implement on processors which support fine-grained page permissions, such as Sun's SPARC and SPARC64 and AMD's AMD64. On processors with more limited features, such as the Intel i386, W^X is implemented using the CS code segment limit as a "line in the sand," a point in the address space above which execution is not permitted and all data is located, and below which it is allowed and code is placed[2]. On all platforms, linker changes were required to separate code (such as trampolines and other code needed for linker and library runtime functions) and data.