Which correctly describes the hardware shadow stack adopted in Intel CET (Control-flow Enforcement Technology) and elsewhere?

Answer: C. On a call, a copy of the return address is also placed on a separate stack that ordinary writes cannot change, and the two are compared on return

If a return address is overwritten by a stack buffer overflow or similar, execution jumps to a place chosen by the attacker when the function returns. With a shadow stack, the call instruction pushes the return address onto both the normal stack and the shadow stack, and the ret instruction compares the two. Shadow-stack pages are a special page type that ordinary store instructions cannot write, so an attacker who overwrote the normal stack cannot change the copy, and a mismatch raises an exception that stops execution.

• A. It is not a mechanism for recovering from abnormal termination.
• B. It is not a mechanism for moving local variables to gain speed but one for protecting return addresses.
• C. Correct. Tampering with the return address is detected just before returning.