RS-Stack: Defense against Stack Buffer Overflow Attack with Random Shadow Stack

Shadow stack is a method to prevent stack buffer overflow attack. However, in the existing shadow stack solutions, it is often supposed that the shadow stack is safe, but the reality is not always the case. To overcome it, this paper presents a stack buffer overflow attack defense method based on dynamic shadow stack, which is called RS-Stack. The outstanding advantage of RS-Stack is that the shadow stack address is random, and it is difficult for attackers to locate the shadow stack. In order to further improve the security, RS-Stack separates the shadow stack address for protection, which makes it difficult for attackers to destroy the contents of the shadow stack. RS-Stack provides double protection for shadow stack. We have partly implemented RS-Stack, and the experiment shows that the shadow stack address splitting protection introduce heavily performance overhead. In order not to affect the performance too much, the address split protection is optional, and this mechanism is only used in the environment with high security requirements.