Comment by cadamsdotcom

It has always been too easy to read & write beyond the stack. This should fail, plain and simple.

Mitigations exist - ASLR, NX pages, stack-smashing protection etc. but nothing comprehensively stops reads of stale data beyond the stack.

Thought experiment for a moment. What if the hardware ensures the unused part of a stack region cannot be read or written.

There are many ways to skin this cat, here’s one based around tracking each stack’s start address A, size S, and current depth D

1. Add an instruction to inform the CPU there is a stack at address A of size S. Its depth D is initially 0.

2. Add a jump instruction which reserves N bytes on the stack at address A, growing depth D to (D+N). Maybe this can be its own “reserve” instruction so as not to need a new jump instruction.

3. Give existing return instructions stack awareness. If returning to an address inside a stack, un-reserve the bytes reserved by the most recent jump, making the new depth (D-N).

4. Fail reads or writes to the stack region beyond its current depth. In other words fail all reads and writes between A+S-D and A+S.

5. The arithmetic is reversed on architectures whose stacks grow downwards.

Downsides I can see:

It cements one calling convention. The CPU memory manager will need a lot of state per stack, of which there are many per process: address A, size S, current depth D, plus a reservation stack - ie. sizes of each frame’s stack memory. That’s a lot of bookkeeping! It’s far from zero cost. The limits of how much bookkeeping the CPU can do impose limits on how deep a stack can go and how many stacks are supported - so when there are too many stacks or one goes too deep, either the CPU needs to signal failure or engage a fallback mode and revert to behaving as CPUs do today. And of course fallback puts things back to the start. It’d therefore only mitigate situations in which an attacker cannot control the depth of the stack / a bug always happens inside the max depth the CPU can bookkeep for.

That said, stacks are ubiquitous! Hardware stack awareness opens up all kinds of new mitigations.

Why isn’t this a common idea? Has it been tried?