Transmeta, Intel, and AMD have already started supporting "No eXecute" (NX) technology in their next core revisions, and now comes an announcement from Red Hat that it will be adding NX support to Linux.

Specifically, Red Hat has just announced the availability of the following kernel patch, which makes use of the "NX" x86 feature pioneered in AMD64 CPUs.

Windows support for NX has also been announced by Microsoft, for their next service pack.

The NX feature is also being marketed as "Enhanced Virus Protection" and this patch, says Red Hat, makes sure Linux has full support for this hardware feature on x86 too.

Red Hat engineer Ingo Molnar explains:

What does this patch do? The pagetable format of current x86 CPUs does not have an "execute'" bit. This means that even if an application maps a memory area without PROT_EXEC, the CPU will still allow code to be executed in this memory. This property is often abused by exploits when they manage to inject hostile code into this memory, for example via a buffer overflow.

The NX feature changes this and adds a "don't execute" bit to the PAE pagetable format. But since the flag defaults to zero (for compatibility reasons), all pages are executable by default and the kernel has to be taught to make use of this bit.

If the NX feature is supported by the CPU then the patched kernel turns on NX and it will enforce userspace executability constraints such as a no-exec stack and no-exec mmap and data areas. This means less chance for stack overflows and buffer-overflows to cause exploits.

Furthermore, adds Molnar, the patch also implements "NX protection" for kernelspace code: only the kernel code and modules are executable - so even kernel-space overflows are harder (in some cases, impossible) to exploit.

• CFO To Depart Red Hat Inc, Just Before Next Quarterly Results Announcement
• "Large-Scale Internet Attack" Warning Issued, Probably Nothing New Though