CME-102

NX/XD Bit (Non-Executable Memory)

Harden OS/Kernel High Confidence

Description

Hardware-enforced memory page permissions that prevent execution of code in data regions (stack, heap), blocking classic code injection.

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Attacker must use ROP/JOP instead of direct shellcode injection

CWE-94 CWE-119 CWE-416

Check CPU supports NX bit and kernel has it enabled

$ grep -q nx /proc/cpuinfo && echo 'NX enabled'
# Expected: NX enabled

Platform: linux

$ dmesg | grep -i 'NX.*protection'
# Expected: NX (Execute Disable) protection: active

Platform: linux

$ (Get-CimInstance Win32_OperatingSystem).DataExecutionPrevention_SupportPolicy
# Expected: 3

Platform: windows

Vendor	Product	CPEs	Platforms	Status
microsoft	windows	`cpe:2.3:o:microsoft:windows_10::::::::` `cpe:2.3:o:microsoft:windows_11::::::::` `cpe:2.3:o:microsoft:windows_server_2019:::::::` `cpe:2.3:o:microsoft:windows_server_2022:::::::`	All	applicable