> Wouldn't there also be a counter-argument that shadow stacks aren't needed so long as you're using random stack canaries and/or W^X. Why have those not become

> Wouldn't there also be a counter-argument that shadow stacks aren't needed so long as you're using random stack canaries and/or W^X. Why have those not become universal and why would shadow stacks have a more practical improvement? Stack canaries can be bypassed if you can find a read vulnerability to disclose a stack canary or disclose the randomness used for generating the canary, or by finding a write vulnerability that permits rewriting the randomness source used for validating the canary. See https://www.s3.eurecom.fr/docs/ifip18_bierbaumer.pdf https://www.s3.eurecom.fr/docs/ifip18_bierbaumer.pdf Stack canaries and W^X are quite ubiquitous. The biggest exceptions are JIT'd code, I think, though some JIT engines do leverage one or both. Shadow stacks in principle are more difficult to defeat--read disclosures alone wouldn't suffice--especially if they're hardware enforced like with Intel CET.