{
  "id": "org.fwupd.hsi.Uefi.NxCompat",
  "name": "Early-boot NX Protection",
  "description": [
    "The UEFI system can set up memory attributes at boot which prevent common exploits from running. For instance, the stack can be marked as non-executable to prevent running any malicious code that can be written to the stack.",
    "In the same way, writing to sections that are read-only can also be prevented, making the system more secure from attackers.",
    "Distribution vendors should tag the bootloader as NX compatible, i.e. compiled with Data Execution Prevention (DEP)."
  ],
  "failure-impact": [
    "The attacker is able to run arbitrary executable code from the stack, or write to memory that is supposed to be read-only."
  ],
  "failure-results": {
    "not-enabled": "the bootloader is not marked as NX compatible"
  },
  "success-results": {
    "enabled": "the bootloader is compiled as NX compatible"
  },
  "hsi-level": 3,
  "resolution": "Contact your OS vendor, who may be able to issue a bootloader update.",
  "references": {
    "https://aka.ms/WHCP": "Microsoft Windows WHCP"
  },
  "fwupd-version": "2.1.6"
}
