[RULE REQUEST] Enforce CET shadow stack compatibility

[michaelcfanning]

Rule Proposal: Enforce CET shadow stack compatibility to defend against return-oriented programming (ROP) based malware attacks.

Rule metadata

• Id: BA2025
• Name: EnableControlEnforcementTechnologyShadowStack
• Failure level: Warning

Rule descriptions

• Short: TBD
• Full: TBD

Platform & applicability

• Platform: Windows
• Applicable to: native with PDBs (required for this analysis)
• Not applicable to: *nix binaries

User-facing strings

• Fail: '{0}' does not enable the Control-flow Enforcement Technology (CET) Shadow Stack mitigation. To resolve this issue, pass /CETCOMPAT on the linker command lines.
• Pass: '{0}' enables the Control-flow Enforcement Technology (CET) Shadow Stack mitigation.

Links/Additional Information

• CETCOMPAT
• Extended DLL Characteristics

Notes on implementation

• Linker option is only available starting in Visual Studio 2019 version 16.7. Rule should therefore examine the linker version details to ensure the toolchain that compiled the binary supports the flag. If the toolchain is too old, the rule CanAnalyze should return MetadataConditions.ImageCompiledWithOutdatedTools. BA2008.EnableControlFlowGuard has an example of this pattern.
• It is occasionally helpful to provide a rule property that controls the version parameterization (this is mostly helpful to overcome issues in toolchain versioning). It's not clear this rule requires this kind of configurability. BA2008.EnableControlFlowGuard has an example of providing a knob for minimal linker version that can be used as a model, however.
• User-facing output should summarize key details from /CETCOMPAT linker option. description and additional security mitigation guidance.
• Rule metadata should capture relevant expanded information and links to external guidance.
• Note that this PE bit is ignored in cases where feature is unsupported by Windows or runtime hardware. This mitigation is an opt-in Windows feature, allowing some flexibility in requiring compiling with /CETCOMPAT (allowing app developers to opt into actual usage).

How to resolve

/CETCOMPAT

[michaelcfanning]

Need to fill out docs, etc.