Intel engineer proposes x86 Kernel Shadow Stacks for Linux
New work aims to bring hardware-enforced shadow stack protection to the Linux kernel to defend against Return Oriented Programming (ROP) attacks.
Summary
Intel engineer Dave Hansen has submitted a Request for Comments (RFC) patch series to introduce x86 Kernel Shadow Stacks to the Linux kernel. While user-space has supported this hardware-enforced control-flow protection for years, the kernel currently lacks it. The implementation requires Flexible Return Event Delivery (FRED) support, limiting it to Intel Panther Lake or newer and AMD Zen 6 or newer CPUs.
Technical requirements and limitations
- Provides a parallel, protected stack specifically for storing return addresses to prevent ROP attacks.
- Requires Flexible Return Event Delivery (FRED) hardware support.
- Hardware compatibility: Intel Panther Lake and newer, or AMD Zen 6 and beyond.
- Current incompatible features include: Retpolines, function graph tracing, BPF trampolines, Kexec, EFI mixed mode, KVM, and Xen PV.
Why it matters
If merged, this would provide one of the most significant silicon-based kernel mitigations available, significantly hardening the Linux kernel against control-flow hijacking.
Original reference: www.phoronix.com →