Detections
Analytics
RHEL-10-701130 - RHEL 10 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
Information
ASLR makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code to repurpose it using return-oriented programming techniques.Solution
Configure RHEL 10 to implement ASLR.$ echo 'kernel.randomize_va_space = 2' | sudo tee /etc/sysctl.d/99-kernel_randomize_va_space.conf
Remove any configurations that conflict with the above from the following locations:
/run/sysctl.d/*.conf
/usr/local/lib/sysctl.d/*.conf
/usr/lib/sysctl.d/*.conf
/lib/sysctl.d/*.conf
/etc/sysctl.conf
/etc/sysctl.d/*.conf
Issue the following command to make the changes take effect:
$ sudo sysctl --system
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R2_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 10 STIG v1r2
Category: SYSTEM AND INFORMATION INTEGRITY
References: 800-53|SI-16, CAT|II, CCI|CCI-002824, Rule-ID|SV-281315r1208802_rule, STIG-ID|RHEL-10-701130, Vuln-ID|V-281315
Plugin: Unix
Control ID: 1e0c12174efe671b9cf0e4001201aaca2e7a303fd4192d0a8d0633c270f2ce8b