Data Execution Prevention is any feature that prevents data from being executed as code. This combats some exploit techniques such as passing exploit code as input and using a vulnerability to cause a jump into the input buffer, or overflowing a data buffer so as to overwrite a code area.

Modern ARM and x86 CPUs can mark virtual memory pages as non-executable; this is known as the NX bit in page tables. Operating systems take advantage of it to a varying extent. DEP features can improve security but can be incompatible with some programs (e.g. just-in-time compilation requires programs to be able to write to a memory buffer then execute it).

Further reading

history | show excerpt | excerpt history