Randomize slab freelist
An XCCDF Rule
Description
Randomizes the freelist order used on creating new pages.
This configuration is available from kernel 5.9, but may be available if backported by distros.
The configuration that was used to build kernel is available at /boot/config-*.
To check the configuration value for CONFIG_SLAB_FREELIST_RANDOM, run the following command:
grep CONFIG_SLAB_FREELIST_RANDOM /boot/config-*
For each kernel installed, a line with value "y" should be returned.
warning alert: Warning
There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.
Rationale
This security feature reduces the predictability of the kernel slab allocator against heap overflows.
- ID
- xccdf_org.ssgproject.content_rule_kernel_config_slab_freelist_random
- Severity
- Medium
- References
- Updated