CET & Shadow Stack
Control Flow Enforcement Technology (CET)
CET is a security feature implemented at the hardware level, designed to thwart common control-flow hijacking attacks such as Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP). These types of attacks manipulate the execution flow of a program to execute malicious code or to chain together pieces of benign code in a way that performs a malicious action.
CET introduces two main features: Indirect Branch Tracking (IBT) and Shadow Stack.
IBT ensures that indirect jumps and calls are made to valid targets, which are marked explicitly as legal destinations for indirect branches. This is achieved through the use of a new instruction set that marks valid targets, thus preventing attackers from diverting the control flow to arbitrary locations.
Shadow Stack is a mechanism that provides integrity for return addresses. It keeps a secured, hidden copy of return addresses separate from the regular call stack. When a function returns, the return address is validated against the shadow stack, preventing attackers from overwriting return addresses on the stack to hijack the control flow.
Shadow Stack
The shadow stack is a dedicated stack used solely for storing return addresses. It works alongside the regular stack but is protected and hidden from normal program execution, making it difficult for attackers to tamper with. The primary goal of the shadow stack is to ensure that any modifications to return addresses on the conventional stack are detected before they can be used, effectively mitigating ROP attacks.
How CET and Shadow Stack Prevent Attacks
ROP and JOP attacks rely on the ability to hijack the control flow of an application by leveraging vulnerabilities that allow them to overwrite pointers or return addresses on the stack. By directing the flow to sequences of existing code gadgets or return-oriented programming gadgets, attackers can execute arbitrary code.
CET's IBT feature makes these attacks significantly harder by ensuring that indirect branches can only jump to addresses that have been explicitly marked as valid targets. This makes it impossible for attackers to execute arbitrary gadgets spread across the binary.
The shadow stack, on the other hand, ensures that even if an attacker can overwrite a return address on the normal stack, the discrepancy will be detected when comparing the corrupted address with the secure copy stored in the shadow stack upon returning from a function. If the addresses don't match, the program can terminate or take other security measures, preventing the attack from succeeding.
Last updated