Detections
Analytics

1.4.1 Ensure address space layout randomization (ASLR) is enabled

Information

Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process.

NOTE Starting from FreeBSD 13.2 ASLR is enabled by default.

Randomly placing virtual memory regions will make it difficult to write memory page exploits as the memory placement will be consistently shifting.

Solution

Set the following parameter in /etc/sysctl.conf :

 - kern.elf64.aslr.enable=1

Example:

# printf "
kern.elf64.aslr.enable=1
" >> /etc/sysctl.conf

Run the following command to set the active kernel parameter:

# sysctl kern.elf64.aslr.enable=1

Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-6b., CCI|CCI-000366, CSCv7|8.3

Plugin: Unix

Control ID: e0559ca53c3af438285c0b70d469355192a6ee281c2d0b986c82d688e8ec9d77