SV-204584r991589: The Red Hat Enterprise Linux operating system must implement virtual address space randomization. | Red Hat Enterprise Linux 7 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Red Hat Enterprise Linux operating system must implement virtual address space randomization.

Description

Discussion Text

Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally, ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it using return-oriented programming (ROP) techniques.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366SV-92521V-77825

References

DPMS Target Red Hat Enterprise Linux 7 DISA DPMS Target Red Hat Enterprise Linux 7 2899

Checks

DISA STIG (Manual Reference)

Verify the operating system implements virtual address space randomization.

     # grep -r kernel.randomize_va_space /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
     kernel.randomize_va_space = 2

If "kernel.randomize_va_space" is not configured in the /etc/sysctl.conf file or or in any of the other sysctl.d directories, is commented out or does not have a value of "2", this is a finding.

Check that the operating system implements virtual address space randomization with the following command:

     # /sbin/sysctl -a | grep kernel.randomize_va_space 
     kernel.randomize_va_space = 2

If "kernel.randomize_va_space" does not have a value of "2", this is a finding.

If conflicting results are returned, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7:def:92521
# The Red Hat Enterprise Linux operating system must implement virtual address space randomization.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - textfilecontent54_object (textfilecontent54_test): <set> composition (base object oval:mil.disa.stig.rhel7:obj:9252101, oval:mil.disa.stig.rhel7:obj:9252102): member unresolved -- no extractor for field "subexpression"

# sysctl_object (sysctl_test)
test_1() {
  [ "$(cat /proc/sys/kernel/randomize_va_space)" -eq 2 ]
}

if test_1; then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel7:def:92521
if [ ! -f "/proc/sys/kernel/randomize_va_space" ]; then echo "PASS"; exit 0; fi
value=$(grep -w "kernel\.randomize_va_space" /proc/sys/kernel/randomize_va_space | awk '{print $2}')
if [ "$value" -eq 2 ]; then echo "PASS"; exit 0; fi
if [ ! -f "/etc/sysctl.conf" ]; then echo "PASS"; exit 0; fi
if grep -q "^\\s*kernel\\.randomize_va_space\\s*=\\s*2\\s*$" /etc/sysctl.conf; then echo "PASS"; exit 0; fi
echo "FAIL"; exit 1

Remediation

Configure the operating system implement virtual address space randomization.

Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a config file in the /etc/sysctl.d/ directory (or modify the line to have the required value):

     kernel.randomize_va_space = 2

Issue the following command to make the changes take effect:

     # sysctl --system