Enable Structured Exception Handling Overwrite Protection (SEHOP)
A `REG_DWORD` value of `0` enables Structured Exception Handling Overwrite Protection (SEHOP) system-wide.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation
A REG_DWORD value of 0 enables Structured Exception Handling Overwrite Protection (SEHOP) system-wide. SEHOP mitigates exploits that use memory corruption to alter the chain of Windows Structured Exception Handling (SEH) handlers.
When an exception occurs, the exception dispatcher validates the SEH chain. Its checks include whether chain records are within the stack boundaries and correctly aligned, whether the chain contains prohibited backward references, and whether it terminates at a known final handler. If validation fails, Windows aborts exception dispatch through that chain and the exception is not handled by the corrupted chain.
Windows provides this protection at run time, so it can also protect applications that were not built with compiler safeguards such as /SAFESEH.
Notes
Security
SEHOP blocks a specific exploitation technique in which an attacker uses memory corruption to replace an SEH record with a pointer to attacker-controlled code. This can prevent or complicate code execution through an SEH overwrite.
The setting does not correct the underlying memory-corruption vulnerability and does not protect against unrelated control-flow or memory-manipulation techniques. Its protective effect applies when an exploit relies on overwriting the SEH chain.
Possible side effects
Compatibility problems are uncommon but can occur in applications that depend on an unusual or corrupted exception chain. The additional validation can also introduce subtle timing changes that expose an existing race condition or multithreading defect. An affected application might fail to handle an exception as expected or terminate unexpectedly.
Notes
The name DisableExceptionChainValidation uses inverted wording: a value of 0 enables exception-chain validation and therefore SEHOP, while a value of 1 disables it. This is a computer-wide registry value.
Microsoft documentation
Microsoft Learn: Exploit protection reference – Validate exception chains (SEHOP)
Microsoft Learn: Azure Policy guest configuration baseline for Windows