Editing Buffer overflow (section)

===Executable space protection===
{{Main|Executable space protection}}

Executable space protection is an approach to buffer overflow protection that prevents execution of code on the stack or the heap. An attacker may use buffer overflows to insert arbitrary code into the memory of a program, but with executable space protection, any attempt to execute that code will cause an exception.

Some CPUs support a feature called [[NX bit|NX]] ("No eXecute") or [[XD bit|XD]] ("eXecute Disabled") bit, which in conjunction with software, can be used to mark [[paging|pages of data]] (such as those containing the stack and the heap) as readable and writable but not executable.

Some Unix operating systems (e.g. [[OpenBSD]], [[macOS]]) ship with executable space protection (e.g. [[W^X]]). Some optional packages include:

* [[PaX]]<ref>{{cite web |title=PaX: Homepage of the PaX team |url=http://pax.grsecurity.net |access-date=2007-06-03}}</ref>
* [[Exec Shield]]<ref>{{cite web |title=KernelTrap.Org |url=http://kerneltrap.org/node/644 |access-date=2007-06-03 |url-status=dead |archive-url=https://archive.today/20120529183334/http://kerneltrap.org/node/644 |archive-date=2012-05-29 }}</ref>
* [[Openwall]]<ref>{{cite web |title=Openwall Linux kernel patch 2.4.34-ow1 |url=http://linux.softpedia.com/get/System/Operating-Systems/Kernels/Openwall-Linux-kernel-patch-16454.shtml |access-date=2007-06-03 |url-status=dead |archive-url=https://web.archive.org/web/20120219111512/http://linux.softpedia.com/get/System/Operating-Systems/Kernels/Openwall-Linux-kernel-patch-16454.shtml |archive-date=2012-02-19 }}</ref>

Newer variants of Microsoft Windows also support executable space protection, called [[Data Execution Prevention]].<ref>{{cite web |title=Microsoft Technet: Data Execution Prevention |url=http://technet2.microsoft.com/WindowsServer/en/Library/b0de1052-4101-44c3-a294-4da1bd1ef2271033.mspx?mfr=true |access-date=2006-06-30 |archive-url=https://web.archive.org/web/20060622140239/http://technet2.microsoft.com/WindowsServer/en/Library/b0de1052-4101-44c3-a294-4da1bd1ef2271033.mspx?mfr=true |archive-date=2006-06-22 |url-status=dead }}</ref> [[proprietary software|Proprietary]] add-ons include:

* BufferShield<ref>{{cite web |title=BufferShield: Prevention of Buffer Overflow Exploitation for Windows |url=http://www.sys-manage.com/english/products/products_BufferShield.html |access-date=2007-06-03}}</ref>
* StackDefender<ref>{{cite web |title=NGSec Stack Defender |url=http://www.ngsec.com/ngproducts/stackdefender/ |access-date=2007-06-03 |archive-url = https://web.archive.org/web/20070513235539/http://www.ngsec.com/ngproducts/stackdefender/ <!-- Bot retrieved archive --> |archive-date = 2007-05-13}}</ref>

Executable space protection does not generally protect against [[return-to-libc attack]]s, or any other attack that does not rely on the execution of the attackers code. However, on [[64-bit]] systems using [[ASLR]], as described below, executable space protection makes it far more difficult to execute such attacks.