Skip to content
TopicTracker
From HackerNewsView original
TranslationTranslation

Fedora 45 Considering x86_64 Shadow Stack Usage by Default

Fedora 45 is evaluating the possibility of enabling x86_64 Shadow Stack technology by default to improve security against control-flow hijacking attacks. This hardware-backed protection mechanism would help prevent return-oriented programming (ROP) and other memory corruption exploits on compatible Intel and AMD processors.

Background

- Fedora is a major open-source Linux distribution known for pioneering features that later appear in Red Hat Enterprise Linux. Fedora 45 is a future release. - A "shadow stack" is a hardware security feature in modern Intel (Tiger Lake+) and AMD (Zen 3+) CPUs that keeps a protected copy of the program's call stack inside the CPU. This blocks entire classes of attacks (like Return-Oriented Programming) that work by corrupting the regular stack. - Linux already supports shadow stacks via Intel CET, but it's currently opt-in per application. Fedora 45 is considering enabling it system-wide by default for all user-space programs on compatible hardware. - Trade-offs: shadow stacks use extra memory and can break software that manually manipulates its call stack (e.g., some debuggers, JIT compilers, or old programs). Enabling it by default requires extensive testing of the entire ecosystem.

Related stories