Linux finally gets its NX support

[n0cmonkey]

kerneltrap

 

[drag]

makes me wish I had a proccessor that supported NX.

 

[n0cmonkey]

If NX is basically the same as per page execution permissions present in SPARC/SPARC64 hardware, I've got 5.

 

[CTho9305]

Linux is lame. OpenBSD has had NX even on i386 by taking advantage of memory segments for ages .

 

[n0cmonkey]

Linux had PaX, which does that.

 

[CTho9305]

Originally posted by: n0cmonkey
Linux had PaX, which does that.

Ithought PaX used a stack canary?

 

[n0cmonkey]

Originally posted by: CTho9305

Originally posted by: n0cmonkey
Linux had PaX, which does that.

Ithought PaX used a stack canary?

PaX also does non-exec stuff. I don't claim to understand all of it, but they do put a lot of documentation out there.

 

[GoingUp]

What is NX for us ignorant people?

 

[CTho9305]

Originally posted by: Gobadgrs
What is NX for us ignorant people?

Non eXecutable. It lets you make parts of memory non-executable. Usually, you make the stack NX, and sometimes you make the heap NX. The simplest class of buffer overflow exploits work by putting exploit code on the stack and running it, so when your stack is NX, the program just crashes. It turns the vast majority of exploits into "denial of service" attacks, where without NX, they'd be "arbitrary code execution" attacks. With a nonexecutable stack, Code Red could never have propagated.

 

[GoingUp]

Originally posted by: CTho9305

Originally posted by: Gobadgrs
What is NX for us ignorant people?

Non eXecutable. It lets you make parts of memory non-executable. Usually, you make the stack NX, and sometimes you make the heap NX. The simplest class of buffer overflow exploits work by putting exploit code on the stack and running it, so when your stack is NX, the program just crashes. It turns the vast majority of exploits into "denial of service" attacks, where without NX, they'd be "arbitrary code execution" attacks. With a nonexecutable stack, Code Red could never have propagated.

So do you want to put that into plain english for the rest of us?

 

[n0cmonkey]

Originally posted by: Gobadgrs

Originally posted by: CTho9305

Originally posted by: Gobadgrs
What is NX for us ignorant people?

Non eXecutable. It lets you make parts of memory non-executable. Usually, you make the stack NX, and sometimes you make the heap NX. The simplest class of buffer overflow exploits work by putting exploit code on the stack and running it, so when your stack is NX, the program just crashes. It turns the vast majority of exploits into "denial of service" attacks, where without NX, they'd be "arbitrary code execution" attacks. With a nonexecutable stack, Code Red could never have propagated.

So do you want to put that into plain english for the rest of us?

I'm not sure how anyone can break it down anymore....

It makes it so that code in memory can't be executed. If code in the memory can't be executed, buffer over flows, the most common form of security vulnerability these days, are impossible.

 

[GoingUp]

Originally posted by: n0cmonkey

Originally posted by: Gobadgrs

Originally posted by: CTho9305

Originally posted by: Gobadgrs
What is NX for us ignorant people?

Non eXecutable. It lets you make parts of memory non-executable. Usually, you make the stack NX, and sometimes you make the heap NX. The simplest class of buffer overflow exploits work by putting exploit code on the stack and running it, so when your stack is NX, the program just crashes. It turns the vast majority of exploits into "denial of service" attacks, where without NX, they'd be "arbitrary code execution" attacks. With a nonexecutable stack, Code Red could never have propagated.

So do you want to put that into plain english for the rest of us?

I'm not sure how anyone can break it down anymore....

It makes it so that code in memory can't be executed. If code in the memory can't be executed, buffer over flows, the most common form of security vulnerability these days, are impossible.

Perfect

 

[CTho9305]

Originally posted by: Gobadgrs

Originally posted by: n0cmonkey

Originally posted by: Gobadgrs

Originally posted by: CTho9305

Originally posted by: Gobadgrs
What is NX for us ignorant people?

Non eXecutable. It lets you make parts of memory non-executable. Usually, you make the stack NX, and sometimes you make the heap NX. The simplest class of buffer overflow exploits work by putting exploit code on the stack and running it, so when your stack is NX, the program just crashes. It turns the vast majority of exploits into "denial of service" attacks, where without NX, they'd be "arbitrary code execution" attacks. With a nonexecutable stack, Code Red could never have propagated.

So do you want to put that into plain english for the rest of us?

I'm not sure how anyone can break it down anymore....

It makes it so that code in memory can't be executed. If code in the memory can't be executed, buffer over flows, the most common form of security vulnerability these days, are impossible.

Perfect

No, buffer overflows still occur, but unless they are even-more-specially crafted, they cause the program to just crash. If they are extra-specially-crafted, you can still take advantage of many buffer overflows - it's just a little more difficult. linus's explanation of getting around NX

 

[n0cmonkey]

Originally posted by: CTho9305

Originally posted by: Gobadgrs

Originally posted by: n0cmonkey

Originally posted by: Gobadgrs

Originally posted by: CTho9305

Originally posted by: Gobadgrs
What is NX for us ignorant people?

Non eXecutable. It lets you make parts of memory non-executable. Usually, you make the stack NX, and sometimes you make the heap NX. The simplest class of buffer overflow exploits work by putting exploit code on the stack and running it, so when your stack is NX, the program just crashes. It turns the vast majority of exploits into "denial of service" attacks, where without NX, they'd be "arbitrary code execution" attacks. With a nonexecutable stack, Code Red could never have propagated.

So do you want to put that into plain english for the rest of us?

I'm not sure how anyone can break it down anymore....

It makes it so that code in memory can't be executed. If code in the memory can't be executed, buffer over flows, the most common form of security vulnerability these days, are impossible.

Perfect

No, buffer overflows still occur, but unless they are even-more-specially crafted, they cause the program to just crash. If they are extra-specially-crafted, you can still take advantage of many buffer overflows - it's just a little more difficult. linus's explanation of getting around NX

Ok, so my simplification was off.

 

[kamper]

sorry if I'm throwing this off topic but: does anyone know if microsoft implements any similar technologies?

Edit: Oops, by reading the link in the OP I see that support is pending. Thanks for the interesting news n0cmonkey

 

[n0cmonkey]

I'm hoping sp2 supports it well. Pretty much every x86 consumer company out there is throwing this feature in. The more software that supports it the better.

 

[kamper]

but if I understood linus' comments there will still be very easy ways to use overflows to gain control? As in, just overwriting the return address on the stack instead of placing executable code there. How much difference will this really make?

 

[drag]

Originally posted by: kamper
but if I understood linus' comments there will still be very easy ways to use overflows to gain control? As in, just overwriting the return address on the stack instead of placing executable code there. How much difference will this really make?

It's just another barrier. Security is a layered thing, each level is flawed and penetrable, but together they make a system secure as it needs to be.

LSM and SELinux have flaws, but make life difficult for crackers. You can use a program to break out of chroot jails. Gsecurity is flawed, as is PaX in it's own way. The NX is a hardware level device so the computer doesn't execute code that isn't ment to be executed in the first place. Firewalls can be broken, and besides buffer overflows there are a plethera of other security problems in software that can be exploited.

Buffer overflows are popular right now because they are easy to find (require not much skill to find) and are sometimes exploitable and often by remote means. It's kinda like a fad, just because MS made it's OS so easily crackable by these means.

But by combining all this then you can get something realy secure.