SI-16 Memory Protection
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Memory Protection
Control
Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: controls].
Discussion
Some adversaries launch attacks with the intent of executing code in non-executable regions of memory or in memory locations that are prohibited. Controls employed to protect memory include data execution prevention and address space layout randomization. Data execution prevention controls can either be hardware-enforced or software-enforced with hardware enforcement providing the greater strength of mechanism.
Parameters
si-16_odp: controls
Related controls
ac-25, sc-3, si-7
Assessment objective
SI-16 [Assignment: controls] are implemented to protect the system memory from unauthorized code execution.
STIG rules that implement this control 23
Application Security and Development V6R5
- APSC-DV-002590 CAT I The application must not be vulnerable to overflow attacks.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-213020 CAT II Ubuntu 22.04 LTS must implement address space layout randomization to protect its memory from unauthorized code execution.
- UBTU-22-213025 CAT II Ubuntu 22.04 LTS must implement nonexecutable data to protect its memory from unauthorized code execution.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-700300 CAT II Ubuntu 24.04 LTS must implement nonexecutable data to protect its memory from unauthorized code execution.
- UBTU-24-700310 CAT II Ubuntu 24.04 LTS must implement address space layout randomization to protect its memory from unauthorized code execution.
Microsoft Windows 11 V2R11
- WN11-00-000150 CAT I Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.
- WN11-CC-000215 CAT II Explorer Data Execution Prevention must be enabled.
Microsoft Windows Server 2022 V2R11
- WN22-CC-000310 CAT II Windows Server 2022 Explorer Data Execution Prevention must be enabled.
- WN22-UR-000160 CAT II Windows Server 2022 lock pages in memory user right must not be assigned to any groups or accounts.
Microsoft Windows Server 2025 V1R4
- WN25-CC-000310 CAT II Windows Server 2025 Explorer Data Execution Prevention must be enabled.
- WN25-UR-000160 CAT II The Windows Server 2025 "Lock pages in memory" user right must not be assigned to any groups or accounts.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-600120 CAT II RHEL 10 must assign a home directory for local interactive user accounts upon creation.
- RHEL-10-700900 CAT II RHEL 10 must implement nonexecutable data to protect its memory from unauthorized code execution.
- RHEL-10-701020 CAT II RHEL 10 must enable mitigations against processor-based vulnerabilities.
- RHEL-10-701060 CAT II RHEL 10 must restrict exposed kernel pointer address access.
- RHEL-10-701130 CAT II RHEL 10 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
- RHEL-10-701190 CAT II RHEL 10 must implement nonexecutable data to protect its memory from unauthorized code execution.
- RHEL-10-800050 CAT II RHEL 10 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time compiler.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-212045 CAT II RHEL 9 must clear memory when it is freed to prevent use-after-free attacks.
- RHEL-09-212050 CAT III RHEL 9 must enable mitigations against processor-based vulnerabilities.
- RHEL-09-213025 CAT II RHEL 9 must restrict exposed kernel pointer addresses access.
- RHEL-09-213070 CAT II RHEL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
- RHEL-09-213110 CAT II RHEL 9 must implement nonexecutable data to protect its memory from unauthorized code execution.