Detections
Analytics

1.341 ALMA-09-044570

Information

AlmaLinux OS 9 must implement nonexecutable data to protect its memory from unauthorized code execution.

GROUP ID: V-269449
RULE ID: SV-269449r1050620

ExecShield uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis.

When the kernel places the memory regions of a process, such as the stack and heap, higher than this address, the hardware prevents execution in that address range.

Solution

Update the GRUB 2 bootloader configuration to ensure the noexec kernel parameter is not enabled using the following command:

$ grubby --update-kernel=ALL --remove-args=noexec

Enable the NX bit execute protection in the system BIOS.

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16, CCI|CCI-002824, Rule-ID|SV-269449r1050620_rule, STIG-ID|ALMA-09-044570, Vuln-ID|V-269449

Plugin: Unix

Control ID: 6d88102762a4e28f3e572ae67be67604559766cfeacef86274276705dd8a3c47