Detections
Analytics

1.190 ALMA-09-024110

Information

AlmaLinux OS 9 must clear the page allocator to prevent use-after-free attacks.

GROUP ID: V-269293
RULE ID: SV-269293r1050175

Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented.

This prevents many types of use-after-free vulnerabilities at little performance cost. This also prevents data leaks and detects corrupted memory.

Solution

Configure AlmaLinux OS 9 to enable page poisoning with the following commands:

$ grubby --update-kernel=ALL --args="page_poison=1"

Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates:

GRUB_CMDLINE_LINUX="page_poison=1"

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-269293r1050175_rule, STIG-ID|ALMA-09-024110, Vuln-ID|V-269293

Plugin: Unix

Control ID: 336c3a05961ec314e3eb0ba5ef4c48089b47cbf48f11d0fe681942a14e67ecfa