diff --git a/00459-apply-intel-control-flow-technology-for-x86-64.patch b/00459-apply-intel-control-flow-technology-for-x86-64.patch new file mode 100644 index 0000000..c6ed738 --- /dev/null +++ b/00459-apply-intel-control-flow-technology-for-x86-64.patch @@ -0,0 +1,68 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Charalampos Stratakis +Date: Wed, 8 Jan 2025 04:58:22 +0100 +Subject: 00459: Apply Intel Control-flow Technology for x86-64 + +Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks + +Proposed upstream: https://github.com/python/cpython/pull/128606 + +See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html +--- + Python/asm_trampoline.S | 22 ++++++++++++++++++++++ + Python/perf_jit_trampoline.c | 4 ++++ + 2 files changed, 26 insertions(+) + +diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S +index 0a3265dfee..616752459b 100644 +--- a/Python/asm_trampoline.S ++++ b/Python/asm_trampoline.S +@@ -9,6 +9,9 @@ + # } + _Py_trampoline_func_start: + #ifdef __x86_64__ ++#if defined(__CET__) && (__CET__ & 1) ++ endbr64 ++#endif + sub $8, %rsp + call *%rcx + add $8, %rsp +@@ -34,3 +37,22 @@ _Py_trampoline_func_start: + .globl _Py_trampoline_func_end + _Py_trampoline_func_end: + .section .note.GNU-stack,"",@progbits ++# Note for indicating the assembly code supports CET ++#if defined(__x86_64__) && defined(__CET__) && (__CET__ & 1) ++ .section .note.gnu.property,"a" ++ .align 8 ++ .long 1f - 0f ++ .long 4f - 1f ++ .long 5 ++0: ++ .string "GNU" ++1: ++ .align 8 ++ .long 0xc0000002 ++ .long 3f - 2f ++2: ++ .long 0x3 ++3: ++ .align 8 ++4: ++#endif // __x86_64__ +diff --git a/Python/perf_jit_trampoline.c b/Python/perf_jit_trampoline.c +index 1211e0e9f1..da9f887769 100644 +--- a/Python/perf_jit_trampoline.c ++++ b/Python/perf_jit_trampoline.c +@@ -473,7 +473,11 @@ elf_init_ehframe(ELFObjectContext* ctx) + DWRF_U8(0); /* Augmentation data. */ + /* Registers saved in CFRAME. */ + #ifdef __x86_64__ ++# if defined(__CET__) && (__CET__ & 1) ++ DWRF_U8(DWRF_CFA_advance_loc | 8); ++# else + DWRF_U8(DWRF_CFA_advance_loc | 4); ++# endif + DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(16); + DWRF_U8(DWRF_CFA_advance_loc | 6); + DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(8); diff --git a/python3.14.spec b/python3.14.spec index 818289a..899c8d7 100644 --- a/python3.14.spec +++ b/python3.14.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ %global prerel a7 %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -368,6 +368,16 @@ Patch454: 00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch # Fix proposed upstream: https://github.com/python/cpython/pull/132357 Patch456: 00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch +# 00459 # 9cf6fed17de184d2e17ace2b5063e782e7e186ba +# Apply Intel Control-flow Technology for x86-64 +# +# Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks +# +# Proposed upstream: https://github.com/python/cpython/pull/128606 +# +# See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html +Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1716,6 +1726,9 @@ CheckPython freethreading # ====================================================== %changelog +* Tue Apr 22 2025 Charalampos Stratakis - 3.14.0~a7-2 +- Apply Intel's CET for mitigation against control-flow hijacking attacks + * Tue Apr 08 2025 Karolina Surma - 3.14.0~a7-1 - Update to Python 3.14.0a7