Exec Shield is a security patch for the Linux kernel that adds an NX bit to x86 CPUs. It was developed by Ingo Molnar of Red Hat, and is used as a part of Fedora Core 1, 2 and 3.

Exec Shield attempts to flag data memory as non-executable and program memory as non-writeable. This surpresses many security exploits, such as those stemming from buffer overflows. Exec Shield also supplies some address space layout randomization for the mmap() and heap base.

Exec Shield works on all x86 CPUs utilizing the Code Segment limit. Because of the way Exec Shield works, it is very lightweight; however, it won't fully protect arbitrary virtual memory layouts. If the CS limit is raised, for example by calling mprotect() to make higher memory executable, then the protections are lost below that limit. Ingo Molnar points this out in an e-mail conversation. Fortunately, most applications are fairly sane at this; the stack (the important part) at least winds up above any mapped libraries, so doesn't become executable except by explicit calls by the application.

As of August, 2004, Exec Shield does not attempt to enforce memory protections by restricting mprotect() on any architecture; although memory may not initially be executable, it may become executable later. Exec Shield will allow an application to mark memory pages as both writable and executable at the same time.

History

This covers Exec Shield's release history. Implementation of PT_GNU_STACK and PT_GNU_HEAP binary markings and the deprication of PT_GNU_HEAP are not yet covered here, nor is infromation on Exec Shield's minimal ASLR.

• May, 2003: Exec Shield first released

External links

• Ingo Molnar's Exec Shield patch web page, includes documentation in the file ANNOUNCE-exec-shield

See also

• NX bit
• PaX
• W^X