[3.12] gh-128605: Add branch protections for x86_64 in asm_trampolineS (#128606) #135094
Conversation
…poline.S (python#128606) Apply Intel Control-flow Technology for x86-64 on asm_trampoline.S. Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks. Manual application is required for the assembly files. See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
|
It looks like the 3.14 & 3.13 backports broke buildbots; please don't merge until that's investigated. |
|
Wait, why is this being backported to 3.12? |
It's a securiy fix to harden Python binary. |
|
!buildbot AMD64 Fedora Stable |
|
🤖 New build scheduled with the buildbot fleet by @vstinner for commit ec66179 🤖 Results will be shown at: https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135094%2Fmerge The command will test the builders whose names match following regular expression: The builders matched are:
|
|
!buildbot AMD64 Fedora Stable |
|
🤖 New build scheduled with the buildbot fleet by @vstinner for commit ec66179 🤖 Results will be shown at: https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135094%2Fmerge The command will test the builders whose names match following regular expression: The builders matched are:
|
Apply Intel Control-flow Technology for x86-64 on asm_trampoline.S.
Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks.
Manual application is required for the assembly files.
See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html