From Oracle Linux 6 Security Technical Implementation Guide
Part of SRG-OS-999999
Associated with: CCI-000366
A common type of exploit is the stack buffer overflow. An application receives from an attacker more data than it is prepared for and stores this information on its stack, writing beyond the space reserved for it. This can be designed to cause execution of the data written on the stack. One mechanism to mitigate this vulnerability is for the system to not allow the execution of instructions in sections of memory identified as part of the stack.
If the system being evaluated is running a Red Hat-compatible operating system kernel, check that the "kernel.exec-shield" kernel parameter is set to "1" in /etc/sysctl.conf. If the system is running an Oracle Unbreakable Enterprise kernel, verify that Oracle's Data Execution Prevention is enabled. First, determine if the system is operating an Oracle Unbreakable Enterprise Kernel (UEK): # uname -r | grep uek If no value is returned, the system is running a Red Hat-compatible kernel. Verify that the "kernel.exec-shield" kernel parameter is set to "1" in the running kernel and /etc/sysctl.conf: # sysctl kernel.exec-shield # grep ^kernel\.exec-shield /etc/sysctl.conf | awk -F= '{ print $2 }' kernel.exec-shield = 1 If there is no value returned, or if a value is returned that is not "1", this is a finding. If the system was found to be running an Unbreakable Enterprise Kernel, verify that DEP is enabled: # dmesg | grep 'NX.*protection:' If there is no value returned, or if a value is returned that is not "NX (Execute Disable) protection: active", this is a finding. Note that this is not a finding when the underlying processor architecture does not support the "Execute Disable" (NX) capability. To determine if the processor supports the NX capability, run the following: # grep nx /proc/cpuinfo If there is no value returned, this is not applicable.
If the system being evaluated is running a Red Hat-compatible operating system kernel, then ensure that the "kernel.exec-shield" kernel parameter is set to "1". If the system is running an Oracle Unbreakable Enterprise Kernel, this parameter does not exist. When an Unbreakable Enterprise Kernel is booted, Oracle's Data Execution Prevention (DEP) feature will leverage the hardware-enforced NX (never execute) bit of compatible CPUs to protect against code being executed from the stack. By default, DEP is enabled. If DEP is not enabled, ensure that the string "noexec=off" does not appear in /boot/grub/grub.conf. First, determine if the system is operating an Oracle Unbreakable Enterprise Kernel (UEK): # uname -r | grep uek If no value is returned, the system is running a Red Hat-compatible kernel. Edit (or add if necessary) the entry in /etc/sysctl.conf for the "kernel.exec-shield" kernel parameter. Ensure that this parameter is set to "1" as in: kernel.exec-shield = 1 If this was not already the default, reboot the system for the change to take effect. If the system was found to be running an Unbreakable Enterprise Kernel, then ensure that the string "noexec=off" is not found in /boot/grub/grub.conf: # grep noexec=off /boot/grub/grub.conf If found, remove the offending kernels from /boot/grub/grub.conf.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer