[tor-bugs] #22563 [Core Tor/Tor]: Many memory pages in tor.exe for Windows violate W^X

Tor Bug Tracker & Wiki blackhole at torproject.org
Sat Jun 10 07:04:12 UTC 2017


#22563: Many memory pages in tor.exe for Windows violate W^X
---------------------------------+-----------------
     Reporter:  arthuredelstein  |      Owner:
         Type:  defect           |     Status:  new
     Priority:  Medium           |  Milestone:
    Component:  Core Tor/Tor     |    Version:
     Severity:  Normal           |   Keywords:
Actual Points:                   |  Parent ID:
       Points:                   |   Reviewer:
      Sponsor:                   |
---------------------------------+-----------------
 A cypherpunk (ticket:21617#comment:5) has reported that the tor.exe
 process in the Tor Expert Bundle on Windows has many `Execute/Read/Write`
 memory pages. I also observe the  same thing for Tor Browser's tor.exe
 process. Also, there are many `Execute/Copy on Write` pages, which I
 suspect, after reading [https://msdn.microsoft.com/en-
 us/library/windows/desktop/aa366786(v=vs.85).aspx#PAGE_EXECUTE_WRITECOPY
 Microsoft documentation], are also effectively `W^X` violations.

 To reproduce on Windows:
 1. Download VMMap: [https://technet.microsoft.com/en-
 us/sysinternals/vmmap.aspx]
 2. Run Tor Browser
 3. Run VMMap and select the tor.exe process
 4. Select View > Expand All
 5. In the bottom table of the VMMap window, examine the Protection column.
 Note many `Execute/Read/Write` and `Execute/Copy on Write` pages, all
 belonging to either tor.exe or DLLs bundled with tor.exe.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22563>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online


More information about the tor-bugs mailing list