We don't have the guard page now, but there is a shadow stack token
there, which cannot be used as a return address.
The overall concern is that we could overflow into a page that we did
not intend. Either another actual shadow stack or something that a page
that the attacker constructed, like the transient scenario Jann described.
Thread (73 messages)
73 messages,
9 authors,
last reply 2018-09-14