Glossary
Shadow stack
A separate, protected stack that stores only return addresses, so a return is allowed only if it matches the address saved at call time.
A shadow stack keeps a second copy of every return address in memory that ordinary writes cannot modify. On each call, the return address is pushed to both the normal stack and the shadow stack; on each ret, the two are compared and a mismatch raises a fault. A stack buffer overflow that overwrites the return address is therefore caught at the next return.
Intel CET provides a hardware shadow stack on recent x86-64 CPUs, enabled with -fcf-protection plus operating system support (Windows' hardware-enforced stack protection, and Linux user space since kernel 6.6). Clang's ShadowCallStack is a software variant for AArch64. See control-flow integrity.