Data Execution Prevention

Data Execution Prevention
Name	Data Execution Prevention
Other names	DEP, NX bit, XD bit, Execute Disable
Inventor	National Security Agency
First released	With Windows XP Service Pack 2 (2004)
Type	Memory protection

Data Execution Prevention. It is a security feature included in modern operating systems intended to prevent an application or service from executing code from a non-executable memory region. This helps protect systems from certain types of malware, particularly those that exploit buffer overflow vulnerabilities to run malicious code. The technology marks specific areas of memory, such as the stack and heap, as non-executable, preventing them from being used to run injected code.

Overview

The primary goal of this feature is to block a common class of attacks where malicious shellcode is placed into a data area of memory and then executed. This technique is frequently used in exploits targeting vulnerabilities in software like Internet Explorer or Microsoft Office. Its development was significantly influenced by security research from organizations like the National Security Agency and was first widely implemented in Microsoft Windows with the release of Windows XP Service Pack 2. Similar protections were concurrently developed for other platforms, including Linux through the PaX project and in variants of BSD.

Implementation

Implementation occurs at both the operating system and CPU architecture levels. The operating system kernel is responsible for managing memory permissions and enforcing the policy. In Microsoft Windows, it can be configured system-wide or for individual applications through the Data Execution Prevention settings in System Properties. On Linux-based systems, support is provided through kernel features and can be controlled via utilities like execshield or PaX. The Android platform also utilizes this protection within its Linux kernel foundation.

Hardware support

Effective enforcement relies on hardware features present in modern processors. Intel markets this capability as the XD bit (Execute Disable), while AMD calls it the NX bit (No Execute). This functionality became standard with the introduction of Intel's Prescott microarchitecture and AMD's Athlon 64 processors. The ARM architecture provides similar support through the XN (Execute Never) bit, which is integral to processors in most smartphones and tablets. Without this hardware foundation, software-based emulation is possible but less efficient.

Software support

Major operating systems have integrated support. Microsoft implemented it in Windows XP, Windows Vista, Windows 7, and all subsequent versions, including Windows Server editions. Apple incorporated it into macOS (originally Mac OS X) and iOS. In the open-source software world, the Linux kernel has supported it since version 2.6.8, with distributions like Red Hat and Ubuntu enabling it by default. Compilers such as GCC and Microsoft Visual Studio can also generate binaries that are compatible with this protection scheme.

Security implications

This technology significantly raises the bar for attackers, forcing them to develop more complex techniques like return-oriented programming or jump-oriented programming to bypass it. It is a foundational component of broader exploit mitigation strategies that often include Address Space Layout Randomization and Control-flow integrity. Its adoption was a direct response to the proliferation of internet worms like Code Red and Sasser. Major security initiatives, including Microsoft's Security Development Lifecycle, mandate its use to harden software against common exploits.

Limitations and circumvention

While effective, it is not a silver bullet and can be circumvented. Advanced attack methods, such as return-to-libc and its generalization, return-oriented programming, reuse existing, legitimate code fragments in executable memory regions like those of the Microsoft Windows DLLs or the GNU C Library. Attackers may also exploit just-in-time compilation in environments like the Java virtual machine or Adobe Flash Player to generate executable code dynamically. Furthermore, some legacy or poorly written applications, including older versions of Microsoft Office or Adobe Acrobat, may malfunction when protected, leading administrators to create exceptions that weaken overall security.

Category:Computer security Category:Computer memory Category:Microsoft Windows security technology