RHEL-10-701130 RHEL 10 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
All changes in this version
Maps to SI-16 via CCI-002824
Title
RHEL 10 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
Control
Verify RHEL 10 is implementing ASLR. Check the status of the "kernel.randomize_va_space" kernel parameter with the following command: $ sudo sysctl kernel.randomize_va_space kernel.randomize_va_space = 2 If "kernel.randomize_va_space" is not set to "2", this is a finding. Check that the configuration files are present to enable this kernel parameter. $ sudo grep -rs kernel.randomize_va_space /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc/sysctl.conf /etc/sysctl.d/*.conf /etc/sysctl.d/99-kernel_randomize_va_space.conf:kernel.randomize_va_space = 2 If "kernel.randomize_va_space" is not set to "2", is missing or commented out, this is a finding. If conflicting results are returned, this is a finding.
Discussion
ASLR makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code to repurpose it using return-oriented programming techniques.
Related controls
CCI-002824
Fix
Configure RHEL 10 to implement ASLR. $ echo 'kernel.randomize_va_space = 2' | sudo tee /etc/sysctl.d/99-kernel_randomize_va_space.conf Remove any configurations that conflict with the above from the following locations: /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc/sysctl.conf /etc/sysctl.d/*.conf Issue the following command to make the changes take effect: $ sudo sysctl --system