Detections
Analytics
1.5.6 Ensure kernel.randomize_va_space is configured
Information
Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process.More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.
Randomly placing virtual memory regions will make it difficult to write memory page exploits as the memory placement will be consistently shifting.
Solution
- Review all files being used by systemd sysctl and comment out or remove all kernel.randomize_va_space lines that are not kernel.randomize_va_space=2.Example script:
#!/usr/bin/env bash
{
l_option="kernel.randomize_va_space" l_value="2"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*([01]|[3-9]|1[0-9]+)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
kernel.randomize_va_space = 2
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "kernel.randomize_va_space = 2" >> /etc/sysctl.d/60-kernel_sysctl.conf
- Run the following command to load all system configuration files:
# sysctl --system
Impact:
Enabling full address space layout randomization ( kernel.randomize_va_space = 2 ) has minimal operational impact. In rare cases, legacy applications or debuggers that assume fixed memory addresses may be affected.
See Also
Item Details
Audit Name: CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server
Category: SYSTEM AND INFORMATION INTEGRITY
References: 800-53|SI-16, CSCv7|8.3
Plugin: Unix
Control ID: 4123dd05835887b60e5b62cc6db824930b5eca88ba6b45af98b039f491c45f4e