CME-113

Control Flow Integrity (CFI / Shadow Call Stack)

Harden OS/Kernel Medium Confidence

Description

Hardware or compiler-enforced control flow integrity that validates indirect branch targets match expected types, blocking ROP/JOP chains. On ARM64, shadow call stack protects return addresses in a separate stack.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	ROP/JOP gadget chains are detected and blocked at runtime

CWE Relationships

CWE-119 CWE-120 CWE-787 CWE-416 CWE-843

Verification

Check kernel config for CFI or Shadow Call Stack

$ grep CONFIG_CFI_CLANG /boot/config-$(uname -r)
# Expected: CONFIG_CFI_CLANG=y

Platform: linux

$ grep CONFIG_SHADOW_CALL_STACK /boot/config-$(uname -r)
# Expected: CONFIG_SHADOW_CALL_STACK=y

Platform: linux

$ (Get-ProcessMitigation -System).CFG.Enable
# Expected: ON

Platform: windows

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
microsoft	windows	`cpe:2.3:o:microsoft:windows_10::::::::` `cpe:2.3:o:microsoft:windows_11::::::::` `cpe:2.3:o:microsoft:windows_server_2019:::::::` `cpe:2.3:o:microsoft:windows_server_2022:::::::`	All	applicable