What is Shadow stack?

A mechanism that, on each function call, also places a copy of the return address on a separate stack that ordinary writes cannot modify, and on return compares it with the value on the normal stack to detect tampering with the return address. On a mismatch an exception is raised and execution stops. It is supported in hardware by Intel CET (Control-flow Enforcement Technology) and others, and makes attacks such as ROP that exploit stack buffer overflows harder.

Japanese name: シャドウスタック

Shadow stack appears in 2 practice questions across 1 topic, including Hardware Security: Advanced Topics and Trends.

Field: Hardware Security: Advanced Topics and Trends

Try it: questions about Shadow stack

Which correctly describes the hardware shadow stack adopted in Intel CET (Control-flow Enforcement Technology) and elsewhere?

AThe contents of the stack are saved to non-volatile memory at regular intervals, and when a program terminates abnormally, execution resumes from them
BLocal variables of functions are placed in fast memory separate from the normal stack, reducing cache misses and speeding up function calls
COn a call, a copy of the return address is also placed on a separate stack that ordinary writes cannot change, and the two are compared on return

Show answer and explanation

Answer: C. On a call, a copy of the return address is also placed on a separate stack that ordinary writes cannot change, and the two are compared on return

If a return address is overwritten by a stack buffer overflow or similar, execution jumps to a place chosen by the attacker when the function returns. With a shadow stack, the call instruction pushes the return address onto both the normal stack and the shadow stack, and the ret instruction compares the two. Shadow-stack pages are a special page type that ordinary store instructions cannot write, so an attacker who overwrote the normal stack cannot change the copy, and a mismatch raises an exception that stops execution.

Shadow stack in the explanations

With a shadow stack, the call instruction pushes the return address onto both the normal stack and the shadow stack, and the ret instruction compares the two.
Which correctly describes the hardware shadow stack adopted…
A shadow stack compares the return address with its copy, and pointer authentication checks the authentication code attached to the return address, so both protect returns from functions.
Regarding hardware features that support control-flow integ…

Questions that mention Shadow stack (2)

Books on Hardware Security: Advanced Topics and Trends Ad

Search Amazon for semiconductor Hardware Security: Advanced Topics and Trends

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary