rpms/python3.14
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Apply Intel's CET for mitigation against control-flow hijacking attacks

Browse source
This commit is contained in:
Charalampos Stratakis 2025-04-23 00:59:59 +02:00
commit eee246a4f2
2 changed files with 82 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

68
00459-apply-intel-control-flow-technology-for-x86-64.patch Normal file
View file

@ -0,0 +1,68 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Wed, 8 Jan 2025 04:58:22 +0100
Subject: 00459: Apply Intel Control-flow Technology for x86-64
Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks
Proposed upstream: https://github.com/python/cpython/pull/128606
See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
---
Python/asm_trampoline.S | 22 ++++++++++++++++++++++
Python/perf_jit_trampoline.c | 4 ++++
2 files changed, 26 insertions(+)
diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S
index 0a3265dfee..616752459b 100644
--- a/Python/asm_trampoline.S
+++ b/Python/asm_trampoline.S
@@ -9,6 +9,9 @@
# }
_Py_trampoline_func_start:
#ifdef __x86_64__
+#if defined(__CET__) && (__CET__ & 1)
+ endbr64
+#endif
sub $8, %rsp
call *%rcx
add $8, %rsp
@@ -34,3 +37,22 @@ _Py_trampoline_func_start:
.globl _Py_trampoline_func_end
_Py_trampoline_func_end:
.section .note.GNU-stack,"",@progbits
+# Note for indicating the assembly code supports CET
+#if defined(__x86_64__) && defined(__CET__) && (__CET__ & 1)
+ .section .note.gnu.property,"a"
+ .align 8
+ .long 1f - 0f
+ .long 4f - 1f
+ .long 5
+0:
+ .string "GNU"
+1:
+ .align 8
+ .long 0xc0000002
+ .long 3f - 2f
+2:
+ .long 0x3
+3:
+ .align 8
+4:
+#endif // __x86_64__
diff --git a/Python/perf_jit_trampoline.c b/Python/perf_jit_trampoline.c
index 1211e0e9f1..da9f887769 100644
--- a/Python/perf_jit_trampoline.c
+++ b/Python/perf_jit_trampoline.c
@@ -473,7 +473,11 @@ elf_init_ehframe(ELFObjectContext* ctx)
DWRF_U8(0); /* Augmentation data. */
/* Registers saved in CFRAME. */
#ifdef __x86_64__
+# if defined(__CET__) && (__CET__ & 1)
+ DWRF_U8(DWRF_CFA_advance_loc | 8);
+# else
DWRF_U8(DWRF_CFA_advance_loc | 4);
+# endif
DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(16);
DWRF_U8(DWRF_CFA_advance_loc | 6);
DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(8);

15
python3.14.spec
View file

@ -17,7 +17,7 @@ URL: https://www.python.org/
%global prerel a7
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
Release: 1%{?dist}
Release: 2%{?dist}
License: Python-2.0.1
@ -368,6 +368,16 @@ Patch454: 00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch
# Fix proposed upstream: https://github.com/python/cpython/pull/132357
Patch456: 00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch
# 00459 # 9cf6fed17de184d2e17ace2b5063e782e7e186ba
# Apply Intel Control-flow Technology for x86-64
#
# Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks
#
# Proposed upstream: https://github.com/python/cpython/pull/128606
#
# See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch
# (New patches go here ^^^)
#
# When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -1716,6 +1726,9 @@ CheckPython freethreading
# ======================================================
%changelog
* Tue Apr 22 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.14.0~a7-2
- Apply Intel's CET for mitigation against control-flow hijacking attacks
* Tue Apr 08 2025 Karolina Surma <ksurma@redhat.com> - 3.14.0~a7-1
- Update to Python 3.14.0a7