Skip to content

0073-addressspac-randomization-enable-Ensure Address Space Layout Randomization (ASLR) Is Enabled

Rule ID

  • 0073-addressspac-randomization-enable

Category

  • system

Severity

  • warn

Supported Versions

  • Linux

Description

  • Address Space Layout Randomization (ASLR) is a vulnerability mitigation technique that randomizes the address space of key data areas in a process.

Scan Frequency

  • 0 */30 * * *

Rationale

  • Randomly placing virtual memory regions makes it difficult to write to memory pages, as memory locations constantly change.

Risk Item

  • Service Unavailable

Audit Method

  • Run the following commands and verify the output matches:
# sysctl kernel.randomize_va_space
kernel.randomize_va_space = 2
# grep "kernel\.randomize_va_space" /etc/sysctl.conf /etc/sysctl.d/*
kernel.randomize_va_space = 2

Remediation

  • Add the following line to /etc/security/limits.conf or in a file under /etc/security/limits.d/*:
kernel.randomize_va_space = 2

Run the following command to set the active kernel parameter:

sysctl -w kernel.randomize_va_space=2

Impact

  • None

Default Value

  • None

References

  • None

CIS Controls

  • Version 7

    8.3 Enable Anti-Exploitation Features on OS / Deploy Anti-Exploitation Technologies Enable anti-exploitation features available on the operating system, such as Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR), or deploy an appropriate toolkit that can be configured to apply protection to a broader set of applications and executables.

Feedback

Is this page helpful?