Bug 2458478

Summary:	libunwind is compiled without Shadow Stack protection
Product:	[Fedora] Fedora	Reporter:	Arjun Shankar <ashankar>
Component:	libunwind	Assignee:	Carlos O'Donell <codonell>
Status:	ASSIGNED ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	45	CC:	codonell, fweimer, jan, mcermak, spotrh
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2458434

Description Arjun Shankar 2026-04-14 21:04:01 UTC

libunwind is built without shadow stack support. Therefore, Fedora applications that link against libunwind are lacking protection at runtime.

As far as I can tell, this is due to some assembly files that are not annotated and an upstream fix already exists for the same:
https://github.com/libunwind/libunwind/commit/84607272d8a9bd8b19d2ac720641feab4bc2dc91
https://github.com/libunwind/libunwind/commit/155b3d90f4a0d5fe99f126da0ddbc6c76d0b3e71

Some background for why this bug is being filed and marked with a "High" severity:

We (the glibc team) are planning to enable Shadow Stack protection by default in Fedora 45, and this bug report is a result of early testing. Here is a WIP/draft Fedora System-Wide Change Proposal: https://fedoraproject.org/wiki/Changes/ShadowStack

There are some notes in the Documentation section of the change proposal on how to identify and fix issues such as these:
https://fedoraproject.org/wiki/Changes/ShadowStack#Documentation
However, in the case of libunwind, backporting the fixes mentioned might suffice.

Reproducible: Always

Comment 1 Tom "spot" Callaway 2026-04-17 19:44:44 UTC

I'm not sure what's going on with the upstream, I think maybe the 1.8.3 code is different from the "master" branch in key ways, but these changes don't seem to apply (even manually) to that tree. I think we might need to wait for upstream to push another stable release.

Comment 2 Aoife Moloney 2026-08-17 14:33:27 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.