|
Malicious buffer
overflow attacks pose a significant security
threat to businesses, increasing IT resource
demands, and in some cases destroying digital
assets. In a typical attack, a malicious worm
creates a flood of code that overwhelms the
processor, allowing the worm to propagate itself
to the network, and other computers.
Intel's
Execute Disable Bit functionality, first
released for the
IntelŪ ItaniumŪ processor family in 2001,
can prevent certain classes of malicious "buffer
overflow" attacks when combined with a
supporting operating system. Execute Disable Bit
allows the processor to classify areas in memory
by where application code can execute and where
it cannot. When a malicious worm attempts to
insert code in the buffer, the processor
disables code execution, preventing damage or
worm propagation. To provide end-to-end no
execute (NX) coverage, Intel will offer Execute
Disable Bit for desktops, workstations, and
other server products beginning in late Q3 2004.
Mobile products begin shipping in late Q4 2004,
with system availability in Q1 2005. |
