The execute disable bit (EDB) is a hardware-based security component of the central processing unit. It helps prevent buffer overflow attacks that can paralyze the processor and infect other computers on a network. Intel processors include the EDB feature, which can be enabled or disabled in the BIOS.
A buffer overflow attack allows malware, such as viruses and worms, to take control of a computer by inserting malicious code into another program's data storage area. The attacker then uses this section of memory to run the malware's code and transfer control of the system from one part of the program to another. EDB prevents this by allowing the CPU to classify certain memory pages as either data or instructions and preventing them from being executed.
Intel's implementation of this technology is called the XD bit, while AMD calls theirs NX bit. Other manufacturers of processors also have their own implementation of the XD/NX feature.
When the NX or XD bit is enabled, the CPU adds an attribute bit to the paging structures used for address translation. This bit, known as the NX or XD flag, is set to 1 if the page is being used for executable code and cleared to 0 if it is being used for data. This flag is applied to every page in the memory that can be accessed by the OS.
When the NX or XD bit flag is set, any attempt to execute code in an unauthorized memory page results in a "page fault" exception in the OS, which is detected by the CPU and causes it to disable execution of the malicious code. This is a significant improvement in system security that can help to keep viruses and worms from running on the computer.
