Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable DEP and ASLR #60836

Closed
tiran opened this issue Dec 7, 2012 · 14 comments
Closed

Enable DEP and ASLR #60836

tiran opened this issue Dec 7, 2012 · 14 comments
Labels
OS-windows type-security A security issue

Comments

@tiran
Copy link
Member

tiran commented Dec 7, 2012

BPO 16632
Nosy @loewis, @jcea, @vstinner, @tiran, @briancurtin, @skrah, @berkerpeksag, @zooba
Files
  • depaslr.patch
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2016-07-30.08:01:32.820>
created_at = <Date 2012-12-07.10:23:01.425>
labels = ['type-security', 'OS-windows']
title = 'Enable DEP and ASLR'
updated_at = <Date 2016-07-30.08:01:32.790>
user = 'https://github.com/tiran'

    bugs.python.org fields:

    activity = <Date 2016-07-30.08:01:32.790>
actor = 'berker.peksag'
assignee = 'none'
closed = True
closed_date = <Date 2016-07-30.08:01:32.820>
closer = 'berker.peksag'
components = ['Windows']
creation = <Date 2012-12-07.10:23:01.425>
creator = 'christian.heimes'
dependencies = []
files = ['28236']
hgrepos = []
issue_num = 16632
keywords = ['patch']
message_count = 14.0
messages = ['177077', '177084', '177216', '177217', '177290', '182970', '201122', '201123', '201145', '203185', '203504', '235218', '235241', '271669']
nosy_count = 11.0
nosy_names = ['loewis', 'jcea', 'vstinner', 'christian.heimes', 'brian.curtin', 'skrah', 'devin', 'python-dev', 'ricky', 'berker.peksag', 'steve.dower']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue16632'
versions = ['Python 3.4']
    @tiran
    Copy link
    Member Author

    tiran commented Dec 7, 2012

    Python 3.3 doesn't use address space layout randomization [1] and data execution prevention [2] on Windows. ASLR and DEP make certain kinds of attacks harder. An attacker can't predict the address of functions or globals anymore and DEP helps against NOP sled attacks.

    Python's test suite runs fine with DEP and ASLR on AMD64. I see a crash in test_capi and a couple of crashes in test_faulthandler but these don't seem to be related.

    [1] http://en.wikipedia.org/wiki/ASLR
    [2] http://en.wikipedia.org/wiki/Data_Execution_Prevention

    @tiran tiran added OS-windows type-security A security issue labels Dec 7, 2012
    @loewis
    Copy link
    Mannequin

    loewis mannequin commented Dec 7, 2012

    I'm +0. There is a risk that this may break 3rd-party extension modules.

    @ebfe
    Copy link
    Mannequin

    ebfe mannequin commented Dec 9, 2012

    Only way to be sure: Enable & announce for 3.5 and wait for bug reports

    @tiran
    Copy link
    Member Author

    tiran commented Dec 9, 2012

    DEP isn't much of an issue. It's automatically disabled for the entire process when one library w/o DEP is loaded.

    @loewis
    Copy link
    Mannequin

    loewis mannequin commented Dec 10, 2012

    I don't think much caution is needed. If problems don't show up in the beta releases, we can still revert the change for 3.4.1.

    Christian, please go ahead and check this in.

    @vstinner
    Copy link
    Member

    I see a crash in test_capi and a couple of crashes
    in test_faulthandler but these don't seem to be related.

    Which kind of crash? faulthandler has functions to make Python crash, crashes are expected :-)

    @vstinner
    Copy link
    Member

    @crys: ping?

    @tiran
    Copy link
    Member Author

    tiran commented Oct 24, 2013

    I'll look in this next time my Windows VM is running.

    @tiran tiran self-assigned this Oct 24, 2013
    @skrah
    Copy link
    Mannequin

    skrah mannequin commented Oct 24, 2013

    I see a crash in test_capi and a couple of crashes
    in test_faulthandler but these don't seem to be related.

    Perhaps the same as bpo-9116.

    @tiran
    Copy link
    Member Author

    tiran commented Nov 17, 2013

    I no longer see the crashs.

    @python-dev
    Copy link
    Mannequin

    python-dev mannequin commented Nov 20, 2013

    New changeset cb1691d42101 by Christian Heimes in branch 'default':
    Issue bpo-16632: Enable DEP and ASLR on Windows.
    http://hg.python.org/cpython/rev/cb1691d42101

    @tiran tiran closed this as completed Nov 20, 2013
    @ricky
    Copy link
    Mannequin

    ricky mannequin commented Feb 2, 2015

    Sorry to revive this old bug, but would it be possible to get ASLR/DEP for windows on the 2.7 branch as well?

    Also, re Christian's comment about DEP being disabled if a single libray doesn't support it - are you sure that's the case? I'm very new to windows stuff, but the only information about this I saw online was http://0xdabbad00.com/2012/12/07/dep-data-execution-prevention-explanation/, which says that only /NXCOMPAT on the EXE matters.

    @vstinner
    Copy link
    Member

    vstinner commented Feb 2, 2015

    I reopen the issue, so the question of porting the change to Python 2.7 can be replied.

    @vstinner vstinner reopened this Feb 2, 2015
    @tiran tiran removed their assignment Jun 12, 2016
    @berkerpeksag
    Copy link
    Member

    This has already been backported to 2.7 in bpo-24508.

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    OS-windows type-security A security issue
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    3 participants
    @berkerpeksag @vstinner @tiran