cis-ubuntu1804-v220-1-5-3

name	cis-ubuntu1804-v220-1-5-3
description	Ensure address space layout randomization (ASLR) is enabled
category	cis-storage
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","aslr","process-hardening","kernel","exploit-mitigation"]
cis_id	1.5.3
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.5.3 Ensure address space layout randomization (ASLR) is enabled (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process.

Rationale

Randomly placing virtual memory regions will make it difficult to write memory page exploits as the memory placement will be consistently shifting.

Audit Procedure

Command Line

Run the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:

• kernel.randomize_va_space is set to 2

#!/usr/bin/env bash
{
    l_output="" l_output2=""
    a_parlist=("kernel.randomize_va_space=2")
    l_ufwscf="$([ -f /etc/default/ufw ] && awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
    a_searchpath=("/run/sysctl.d/" "/etc/sysctl.d/" "/usr/local/lib/sysctl.d/" "/usr/lib/sysctl.d/" "/lib/sysctl.d/")
    unset A_files
    declare -A A_files
    A_files+=(["sysctl.conf"]="/etc/sysctl.conf")
    for l_searchpath in "${a_searchpath[@]}"; do
        if [ -d "$l_searchpath" ]; then
            while IFS= read -r -d $'\0' l_filename; do
                if [ -f "$l_filename" ]; then
                    l_basename=
                     [ -z  ]; 
                        A_files+=([]=)
                    
                
             < <(find  - f -name  -print0)
        
    
    a_sorted=()
     IFS=  -rd  l_key; 
        a_sorted+=(  )
     < <(   |  -rz)
    ()
    {
        l_var= l_var2=
        l_krp=
         [  =  ]; 
            l_output=
        
            l_output2=
        
    }
     IFS=  -r l_kpname l_kpvalue; 
        l_kpname=; l_kpvalue=
        kernel_parameter_chk
     < <(  )
     A_files;  a_sorted
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}