Details

Set the system flag to force randomized virtual memory region placement.

*Rationale*

Randomly placing virtual memory regions will make it difficult to write memory page

exploits as the memory placement will be consistently shifting.

Solution

Add the following line to the /etc/sysctl.conf file.kernel.randomize_va_space = 2

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/91

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.

References

• 800-53|SC-30(2)

Source

• Tenable.com/audits