Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #84434

Bug#1086695: linux: Enable X86 userspace shadow stack

Cross-posted to 2 groups.

Show all headers | View raw

Source: linux
Version: 6.11.5-1
Severity: wishlist
Tags: patch
X-Debbugs-Cc: miguel.bernal.marin@linux.intel.com, jair.gonzalez@linux.intel.com

Dear Maintainer,

Please enable the "X86 userspace shadow stack" (X86_USER_SHADOW_STACK).
Shadow stack protection is a hardware feature that detects function
return address corruption.  This helps mitigate ROP (Return-oriented
programming) attacks. Applications must be enabled to use it, and old
userspace does not get protection "for free".

Shadow stack works by maintaining a secondary (shadow) stack that cannot be 
directly modified by applications. When executing a CALL instruction, the 
processor pushes the return address to both the normal stack and to the special 
permission shadow stack. Upon RET, the processor pops the shadow stack copy 
and compares it to the normal stack copy. If the two differ, the processor 
raises a control protection fault. This implementation supports shadow stack on 
64 bit kernels only, with support for 32 bit only via IA32 emulation.

CPUs supporting shadow stacks were first released in 2020.

See https://docs.kernel.org/arch/x86/shstk.html for more information.

A MR was created with this proposal at:

https://salsa.debian.org/kernel-team/linux/-/merge_requests/1253

Thanks,
Miguel Bernal Marin

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1086695: linux: Enable X86 userspace shadow stack Miguel Bernal Marin <miguel.bernal.marin@gmail.com> - 2024-11-04 07:50 +0100
  Bug#1086695: marked as done (linux: Enable X86 userspace shadow  stack) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-11-11 07:20 +0100

csiph-web