Protecting Against Return Oriented Programming Attacks with CET-SS

CVE-2023-46841

What is CVE-2023-46841?

A technical vulnerability in the Xen Hypervisor arises from the interaction between Control-flow Enforcement Technology (CET) and its sub-feature, Shadow Stacks. Shadow Stacks are designed to bolster security against Return Oriented Programming attacks by maintaining a separate, non-writable stack that only holds return addresses. However, an issue has been identified where certain memory accesses, crucial for proper function, are not being intercepted, leading to a problematic emulation process involving instruction replay. This flaw specifically occurs during the recovery process, where the removal of a call frame from the traditional stack occurs without the corresponding operation taking place for the shadow stack, potentially compromising the integrity of return addresses.

References