Skip to content
Log In

Enable page allocator poisoning

An XCCDF Rule

Description

To enable poisoning of free pages, add the argument page_poison=1 to the default GRUB 2 command line for the Linux operating system. Configure the default Grub2 kernel command line to contain page_poison=1 as follows: 
# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) page_poison=1"

Rationale

Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.

ID
xccdf_org.ssgproject.content_rule_grub2_page_poison_argument
Severity
Medium
References
Updated

Remediation Templates

OS Build Blueprint

[customizations.kernel]
append = "page_poison=1"

script:kickstart

bootloader page_poison=1

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - grub2_page_poison_argument

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel && { rpm --quiet -q grub2-common; }; then
grubby --update-kernel=ALL --args=page_poison=1

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi