Tag Info

About

Data Execution Prevention is any feature that prevents data from being executed as code. This combats some exploit techniques such as passing exploit code as input and using a vulnerability to cause a jump into the input buffer, or overflowing a data buffer so as to overwrite a code area.

Modern ARM and x86 CPUs can mark virtual memory pages as non-executable; this is known as the NX bit in page tables. Operating systems take advantage of it to a varying extent. DEP features can improve security but can be incompatible with some programs (e.g. just-in-time compilation requires programs to be able to write to a memory buffer then execute it).

Further reading

history | show excerpt | excerpt history