1.5.9 Ensure kernel.randomize_va_space is configured

Information

Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process.

More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

Randomly placing virtual memory regions will make it difficult to write memory page exploits as the memory placement will be consistently shifting.

Solution

- Review all files being used by systemd sysctl and comment out or remove all kernel.randomize_va_space lines that are not kernel.randomize_va_space=2.

Example script:

#!/usr/bin/env bash

{
l_option=\"kernel.randomize_va_space\" l_value=\"2\"
l_grep=\"${l_option//./(\\.|\\/)}\" a_files=()
l_systemdsysctl=\"$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)\"
l_ufw_file=\"$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"
[ -f \"$(readlink -e \"$l_ufw_file\")\" ] && \
a_files+=(\"$l_ufw_file\"); a_files+=(\"/etc/sysctl.conf\")
while IFS= read -r l_fname; do
l_file=\"$(readlink -e \"${l_fname//# /}\")\"
[ -n \"$l_file\" ] && ! grep -Psiq -- '(^|\h+)'\"$l_file\"'\b' \
<<< \"${a_files[*]}\" && a_files+=(\"$l_file\")
done < <(\"$l_systemdsysctl\" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in \"${a_files[@]}\"; do
grep -Psio -- '\h*'\"$l_grep\"'\h*=\h*\H+\b' \"$l_file\" \
| grep -Psivq -- '^\h*'\"$l_grep\"'\h*=\h*'\"$l_value\"'\b' && \
sed -ri '/^\s*'\"$l_grep\"'\s*=\s*([01]|[3-9]|1[0-9]+)/s/^/# /' \"$l_file\"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:

kernel.randomize_va_space = 2

Example:

# [ ! -d \"/etc/sysctl.d/\" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' \"\" \"kernel.randomize_va_space = 2\" >> /etc/sysctl.d/60-kernel_sysctl.conf

Note: If the UFW file was the first file listed in the audit, the entry will be commented out as part of the first step, however updating Uncomplicated Firewall (UFW) may update this change. In this case the updated entry will supersede the entry being created as part of this step.

- Run the following command to load all system configuration filles:

# sysctl --system

Item Details

Audit Name: CIS Debian Linux 13 v1.0.0 L1 Server

Category: SYSTEM AND INFORMATION INTEGRITY

Plugin: Unix

Control ID: 62bdec44ca76b621fd3f21e5182c88a7039334c91dd857004cdc6bb3e0d24d18

Detections

Analytics

1.5.9 Ensure kernel.randomize_va_space is configured

Information

Solution

See Also

Item Details