BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Writing to Shadow Stacks\n   Tags: DEF CON Official 
 Talk | Demo 💻 | Exploit 🪲\n   When: Saturday\, Aug 8\, 12:30 - 13:30
  PDT\n   Where: LVCCW Level 1 Hall 3 1007 (Main Track 2) and DCTV-2 - [1]M
 ap\n\n   Description:\n\n   CET shadow stacks are supposed to make return-
 address corruption a\n   dead end. This talk presents three techniques tha
 t write\n   attacker-chosen values directly into shadow stack memory on Li
 nux.\n\n   The first uses /proc/self/mem. The kernel's FOLL_FORCE flag ove
 rrides\n   shadow stack page protections\, letting an unprivileged process
  write\n   to its own shadow stack with open() and pwrite(). Works on x86-
 64 CET\n   and ARM64 GCS. After our report\, Linus Torvalds merged commit\
 n   599bbba5a36f to restrict this path. A fork+ptrace variant still works\
 n   on patched kernels. No distribution ships the new default yet.\n\n   T
 he second uses userfaultfd. We register a fault handler on the shadow\n   
 stack VMA\, discard a page with MADV_DONTNEED\, and when RET faults on\n  
  the missing page\, provide a replacement filled with chosen return\n   ad
 dresses. The kernel maps it with valid shadow stack PTE encoding.\n   Not 
 blocked by the /proc/self/mem patch.\n\n   The third uses Intel's WRSSQ in
 struction\, which writes to shadow stack\n   pages from user mode. We corr
 ected a widespread encoding bug in prior\n   PoC code (0x66 prefix produce
 s ADCX\, not WRSSQ) and confirmed it on\n   Sapphire Rapids bare metal.\n\
 n   Validated against three CVEs (dnsmasq\, libinput\, rsync) with demos o
 n\n   bare metal\, including a root shell with CET still enabled.\n\n     
 1. \n\n       Intel\, "Control-flow Enforcement Technology Specification\,
 " Rev.\n       3.0\, 2019.\n\n         1. \n\n           ARM\, "Guarded Co
 ntrol Stack (GCS) Extension\," Arm Architecture\n           Reference Manu
 al for A-profile architecture.\n\n         2. \n\n           Linux kernel 
 source\, mm/gup.c and fs/proc/base.c\, including\n           FOLL_FORCE\, 
 /proc/*/mem\, and VM_SHADOW_STACK handling.\n\n         3. \n\n           
 Lindenmeier and Schwarz\, "Ghost in the Stack: CET Shadow Stack\n         
   Bypass\," Black Hat Europe 2025.\n\n         4. \n\n           Muench et
  al.\, "Control Flow-Oriented Programming\," USENIX\n           Security 2
 025.\n\n         5. \n\n           Schuster et al.\, "Counterfeit Object-o
 riented Programming: On\n           the Difficulty of Preventing Code Reus
 e Attacks in C++\n           Applications\," IEEE S&P 2015.\n\n         6.
  \n\n           CVE-2017-14493\, dnsmasq stack buffer overflow.\n\n       
   7. \n\n           CVE-2022-1215\, libinput format string vulnerability.\
 n\n         8. \n\n           CVE-2024-12084\, rsync heap buffer overflow.
 \n\n   SpeakerBio:  Vladimir "G1ND1L4" Tokarev\, Cyera\n\n   Vladimir Toka
 rev is a vulnerability researcher tech lead at Cyera\,\n   specializing in
  Cloud\, IoT/OT\, Windows\, Linux\, and AI vulnerability\n   research and 
 exploit. Talks: Black Hat USA 2024 and 2023\,\n   DEF CON 33 Recon Village
  2025\, CodeBlue 2025\, RSA 2024.\n\n   '\n\n   1. #LVCCW_Level1_Hall3\n\n
 \n
DTEND:20260808T203000Z
DTSTART:20260808T193000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 1007 (Main Track 2) and DCTV-
 2
SUMMARY:Writing to Shadow Stacks
END:VEVENT
END:VCALENDAR