W^X policy??
W^X policy violation affects Windows drivers compiled in VS 2013 and previous
11–20 of 30 posts
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#12W^X policy??
https://en.wikipedia.org/wiki/W%5EX
Also known as DEP under Windows: https://en.wikipedia.org/wiki/Data_Execution_Prevention
Or more general: NX: https://en.wikipedia.org/wiki/NX_bit
There should probably be a definitive name for this.
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#13W^X policy??
https://en.wikipedia.org/wiki/W%5EX Also known as DEP under Windows: https://en.wikipedia.org/wiki/Data_Execution_Prevention Or more general: NX: https://en.wikipedia.org/wiki/NX_bit There should probably be a definitive name for this.
Thank you.
[edit] I understand HN prefers to use the original headline when linking and the source has no need to explain the term but I do so enjoy learning new things from HN.
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#14W^X policy??
[deleted]
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#15W^X policy??
Writable exclusive OR eXecutable policy, applied to memory pages it makes memory safety bugs a lot harder to exploit, as an attacker can't simply load an executable payload (typically, shellcode) in the address space of the exploited program and jump to it...
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#16Is there a flag to mitigate this at link time?
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#17Earlier quoted context omitted.
Someone always tries to make this comment when a security vulnerability comes up, and it's just as silly every time. If Microsoft asked him to investigate this, then paid him nothing then sure, you can call it "free work". But really, it's just that the author was interested in this one particular thing and decided to investigate it as a hobby and sent his findings in. The company shouldn't be expected to pay for it,…
I didn't say Microsoft is in the wrong. I think he is naive if he thinks they care or even really appreciate it though. They didn't even give him proper responses.
I suspect the fuzzy feeling was more that his discovery seemed to have caused Windows to be changed. Who wouldn't feel some kind of emotion at that?
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#18ugh. At the root, this issue is probably an oversight. Understanding why things are discardable and pageable is interesting though. Memory is pageable because live memory is precious. Your multi-tasking OS that supports paging can dynamically load and unload pages of memory to a backing store, say, disk. This means that if the sum of the memory being used by all tasks is greater than the physical memory available on…
The whole DISCARDABLE thing was a relic of pre-NT versions of Windows, back when people were just beginning to realize that 640K was not, in fact, enough for everybody. I'm surprised the kernel pays any attention to it at all anymore. There's not much upside to paging memory associated with drivers in and out. Certainly not worth the additional attack surface that you get by making things more complicated than necess…
Pre-NT? Are you sure? My understanding of history is that the PE file format was part of NT 3. I would have thought that earlier systems kept as much paged as possible, but maybe that's wrong.
Maybe it's not worth it any more. My phone has 8GB of memory. I do remember a time when you could boot Windows XP on a system with 64MB of RAM when you needed special configuration / custom kernels to boot Linux on such a system. You would think that this was because of the pile of small choices made to relieve memory pressure...
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#19Earlier quoted context omitted.
The whole DISCARDABLE thing was a relic of pre-NT versions of Windows, back when people were just beginning to realize that 640K was not, in fact, enough for everybody. I'm surprised the kernel pays any attention to it at all anymore. There's not much upside to paging memory associated with drivers in and out. Certainly not worth the additional attack surface that you get by making things more complicated than necess…
Pre-NT? Are you sure? My understanding of history is that the PE file format was part of NT 3. I would have thought that earlier systems kept as much paged as possible, but maybe that's wrong. Maybe it's not worth it any more. My phone has 8GB of memory. I do remember a time when you could boot Windows XP on a system with 64MB of RAM when you needed special configuration / custom kernels to boot Linux on such a syste…
In userland, the DISCARDABLE and MOVABLE flags date back at least to Windows 3. Not sure about the kernel.
Re: W^X policy violation affects Windows drivers compiled in VS 2013 and previous
#20Earlier quoted context omitted.
Pre-NT? Are you sure? My understanding of history is that the PE file format was part of NT 3. I would have thought that earlier systems kept as much paged as possible, but maybe that's wrong. Maybe it's not worth it any more. My phone has 8GB of memory. I do remember a time when you could boot Windows XP on a system with 64MB of RAM when you needed special configuration / custom kernels to boot Linux on such a syste…
In userland, the DISCARDABLE and MOVABLE flags date back at least to Windows 3. Not sure about the kernel.
That would have been a different file format though, right?