Current-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

NetBSD Security Advisory 2010-004: amd64 per-page No-execute (NX) bit disabled

Hash: SHA1

                 NetBSD Security Advisory 2010-004

Topic:          amd64 per-page No-execute (NX) bit disabled

Version:        NetBSD-current:         affected prior to April 19, 2010
                NetBSD 5.0.*:           affected
                NetBSD 5.0:             affected
                NetBSD 4.0.*:           not affected
                NetBSD 4.0:             not affected

Severity:       Possible execution of arbitrary code without memory protection

Fixed:          NetBSD-current:         April 19, 2010
                NetBSD-5-0 branch:      April 22, 2010
                NetBSD-5 branch:        April 22, 2010

Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.


An issue in the x86 CPU features detection code disables the use of the
per-page NX bit under amd64, making it impossible to mark certain pages
of memory as not being executable.

Technical Details

The NX bit from AMD (equivalent to the XD bit for Intel) indicates if
the processor supports the NX bit feature (execution right enforced
on a per-page basis). This bit is obtained through the "extended
feature flags" cpuid instruction, inside %edx.

All amd64 code, especially pmap(9), checks for this feature through the
cpu_feature variable. It is set in src/sys/arch/amd64/amd64/locore.S:
- - first with the "feature flags" cpuid instruction (cpuid + %eax = 1),
- - then ORed with the "extended feature flags" cpuid (cpuid + %eax =

When entering init_x86_64(), the value is erased by the cpu_probe() call.
beginning of cpu_probe():
- - cpuid instruction (%eax == 1) flags gets stored in
in x86_cpu_topology():
- - cpuid instruction (%eax == 0x8000_0001) flags get stored in
end of cpu_probe():
- - cpu_feature_flags is then set (or ANDed) with
cpu_info_primary->ci_feature_flags, losing the CPUID_NOX bit in the process
(which is expected to be found in ci_feature3_flags)

Following this, the MSR enabling the NX feature (EFER_NXE) is never set. As
a consequence, the NX bit support is deactivated, and no exception will
be raised even if an instruction is fetched from a page marked as not being

Solutions and Workarounds

No workaround to the problem is currently known. Users are advised to
restrict access to the system to trusted users only, both locally and

When considered individually, this issue is not directly exploitable.
Only programs depending on execution's right enforcement in memory
may be affected, as well as badly written ones where stack, heap
and/or data sections could be used to inject and execute a
specifically crafted payload.

The following instructions describe how to upgrade your kernel
binaries by updating your source tree and rebuilding and
installing a new version of the kernel.

For all NetBSD versions, you need to obtain fixed kernel sources,
rebuild and install the new kernel, and reboot the system.
The fixed source may be obtained from the NetBSD CVS repository.
The following instructions briefly summarise how to upgrade your
kernel.  In these instructions, replace:

  ARCH     with your architecture (from uname -m), and                  
  KERNCONF with the name of your kernel configuration file.    

To update from CVS, re-build, and re-install the kernel:

        # cd src
        # cvs update -d -P sys/arch/x86
        # cvs update -d -P sys/arch/amd64
        # ./ kernel=KERNCONF
        # mv /netbsd /netbsd.old
        # cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
        # shutdown -r now

For more information on how to do this, see:

Thanks To

Jeremy Morse and Jean-Yves Migeon for independently finding and reporting
the issue, and Jean-Yves Migeon for providing a patch.

Revision History

        2010-04-26      Initial release

More Information

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at

Information about NetBSD and NetBSD security can be found at and

Copyright 2010, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2010-004.txt,v 1.1 2010/04/25 21:37:39 tonnerre Exp $
Version: GnuPG v1.4.10 (NetBSD)


Home | Main Index | Thread Index | Old Index