Detections
Analytics

1.384 RHEL-10-701130

Information

RHEL 10 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.

GROUP ID: V-281315RULE ID: SV-281315r1167095

ASLR makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code to repurpose it using return-oriented programming techniques.

Solution

Configure RHEL 10 to implement ASLR.

Create the drop-in if it does not already exist:

$ sudo vi /etc/sysctl.d/99-kernel_randomize_va_space.conf

Add the following line to the file:

kernel.randomize_va_space = 2

Reload settings from all system configuration files with the following command:

$ sudo sysctl --system

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16, CAT|II, CCI|CCI-002824, Rule-ID|SV-281315r1167095_rule, STIG-ID|RHEL-10-701130, Vuln-ID|V-281315

Plugin: Unix

Control ID: 51365630fea09847095dd7358907431c0358b8f59b18758846c63a6060ffae7c