How to protect the Shadow Stack?

Question

I found out that many protection mechanisms are used in computer security to ensure control-flow integrity, one of these mechanisms is the Shadow stack:

The principal is very easy it ensure the integrity of return address of functions. In fact the return address located in the stack is compared to the one pushed in the shadow stack.

There are several implementation of the Shadow stack, one of them consist of modifying the function epilogue and prologue(to make it write in the Shadow stack and load from it for the check).

The question is: If the functions in user space are allowed to write in the shadow stack, how can we prevent the attacker to write/modify the Shadow stack?

Answer 1

It can't be protected completely, but that is not the purpose of the shadow stack. The shadow stack prevents modification of stack by a buffer overflow in local variable (variable on stack), not by arbitrary code. If the attacker already can execute arbitrary code, it is game over.

Answer 2

Protecting the shadow stack is quite expensive, protection could be at hardware level. To answer your question you can find more on protecting the Shadow Stack here:

https://people.eecs.berkeley.edu/~daw/papers/shadow-asiaccs15.pdf

T. H. Dang, P. Maniatis, and D. Wagner. The performance cost of shadow stacks and stack canaries. In 10th ACM Symposium on Information, Computer and Communications Security, ASIACCS, 2015.

https://www.ethz.ch/content/dam/ethz/special-interest/infk/inst-cs/lst-dam/documents/Publications/DIMVA_2015.pdf

M. Payer, A. Barresi, and T. R. Gross. Fine-grained control- flow integrity through binary hardening. In 12th Conference on Detection of Intrusions and Malware and Vulnerability Assessment, DIMVA, 2015.