Detections
Analytics

1.371 RHEL-10-701000

Information

RHEL 10 must clear the page allocator to prevent use-after-free attacks.

GROUP ID: V-281302RULE ID: SV-281302r1167056

Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. It also prevents data leakage and detection of corrupted memory.

Solution

Configure RHEL 10 to enable page poisoning with the following commands:

$ sudo grubby --update-kernel=ALL --args="page_poison=1"

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-3, CAT|II, CCI|CCI-001084, Rule-ID|SV-281302r1167056_rule, STIG-ID|RHEL-10-701000, Vuln-ID|V-281302

Plugin: Unix

Control ID: 7723dc67d3fd91aac6b56ccd1b8259195b141472f9c4be9527c1a67130570354