CME-924
Arbitrary Code Guard (ACG)
Description
Windows exploit protection mitigation that prevents allocating memory pages as executable. Enforces W^X (write XOR execute) policy at runtime by blocking dynamic code generation and preventing RWX page allocations. Blocks JIT-spray attacks, code injection, and return-oriented programming (ROP) by ensuring that memory pages are either writable or executable, never both. Applications must opt-in via SetProcessMitigationPolicy or inherit from system-wide policy.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Memory corruption exploitation requires bypassing W^X; cannot inject executable code |
| Integrity (I) | H → L | Prevents arbitrary code execution after memory write; ROP/JIT spray attacks blocked |
CWE Relationships
Verification
Check ACG mitigation status for process or system-wide
$ Get-ProcessMitigation -Name <process>.exe | Select-Object -ExpandProperty ACG | Select-Object -ExpandProperty Enable
# Expected: ON
# Expected: ON
Platform: windows
$ Get-ProcessMitigation -System | Select-Object -ExpandProperty ACG | Select-Object -ExpandProperty Enable
# Expected: ON (for system-wide enforcement)
# Expected: ON (for system-wide enforcement)
Platform: windows
$ Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel' -Name MitigationOptions | Select-Object -ExpandProperty MitigationOptions
# Expected: ACG enabled in bitmask
# Expected: ACG enabled in bitmask
Platform: windows