TMA-COS-1.4.3
Ensure address space layout randomization (ASLR) is enabled
MediaNivel 1Automatizadacos
Descripción
Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process. Randomly placing virtual memory regions will make it difficult to write memory page exploits as the memory placement will be consistently shifting.
Cómo se verifica
Método de auditoría: Comando de shell
shell
chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk kernel.randomize_va_space 2; then echo compliant; fi- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Set the following parameter in /etc/sysctl.conf or a /etc/sysctl.d/* file: kernel.randomize_va_space = 2 Run the following command to set the active kernel parameter: # sysctl -w kernel.randomize_va_space=2
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- container-optimized-oscos
- Referencia
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.4.3 Ensure address space layout randomization (ASLR) is enabled
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target cos