Enable poison without sanity check
An XCCDF Rule
Description
Skip the sanity checking on alloc, only fill the pages with poison on free. This reduces some
of the overhead of the poisoning feature.
This configuration is available from kernel 4.6.
The configuration that was used to build kernel is available at /boot/config-*.
To check the configuration value for CONFIG_PAGE_POISONING_NO_SANITY, run the following command:
grep CONFIG_PAGE_POISONING_NO_SANITY /boot/config-*
For each kernel installed, a line with value "y" should be returned.
warning alert: Warning
There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.
Rationale
This configuration helps alleviates the performance impact of poisonining.
- ID
- xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning_no_sanity
- Severity
- Medium
- References
- Updated