Enable poison of pages after freeing
An XCCDF Rule
Description
Fill the pages with poison patterns after free_pages() and verify the patterns before
alloc_pages. This does have a potential performance impact if enabled with the "page_poison=1"
kernel boot option.
This configuration is available from kernel 4.6.
The configuration that was used to build kernel is available at /boot/config-*.
To check the configuration value for CONFIG_PAGE_POISONING, run the following command:
grep CONFIG_PAGE_POISONING /boot/config-*
For each kernel installed, a line with value "y" should be returned.
warning alert: Warning
There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.
Rationale
The filling of the memory helps reduce the risk of information leaks from freed data.
- ID
- xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning
- Severity
- Medium
- References
- Updated