OpenControls Logo

STIG Viewer

STIGViewer Support

RHEL 10 must clear memory when it is freed to prevent use-after-free attacks.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-281303RHEL-10-701010SV-281303r1167059_ruleCCI-001084medium
Description
Some adversaries launch attacks with the intent of executing code in nonexecutable regions of memory or in memory locations that are prohibited. Security safeguards employed to protect memory include, for example, data execution prevention and address space layout randomization. Data execution prevention safeguards can be either hardware-enforced or software-enforced, with hardware providing the greater strength of mechanism. Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. It also prevents data leakage and detection of corrupted memory. "init_on_free" is a Linux kernel boot parameter that enhances security by initializing memory regions when they are freed, preventing data leakage. This process ensures that stale data in freed memory cannot be accessed by malicious programs. SLUB canaries add a randomized value (canary) at the end of SLUB-allocated objects to detect memory corruption caused by buffer overflows or underflows. Redzoning adds padding (red zones) around SLUB-allocated objects to detect overflows or underflows by triggering a fault when adjacent memory is accessed. SLUB canaries are often more efficient and provide stronger detection against buffer overflows compared to redzoning. SLUB canaries are supported in hardened Linux kernels such as the ones provided by Linux-hardened. SLAB objects are blocks of physically contiguous memory. SLUB is the unqueued SLAB allocator.
STIGDate
Red Hat Enterprise Linux 10 Security Technical Implementation Guide2026-03-11

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

END-16Restrict Access To Security Functions
0.50
SEA-04.1Security Function Isolation
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (29) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-3Access Enforcement
1.00
AC-3(13)Attribute-based Access Control
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(8)Privilege Levels for Code Execution
1.00

+19 more (top 10 by confidence shown)

CCI1 mapping
CCI-001084
1.00

Details

Check Text (C-281303r1167059_chk)

Verify RHEL 10 is configured so that the current GRUB2 configuration mitigates use-after-free vulnerabilities by employing memory poisoning. Check that the current GRUB2 configuration mitigates use-after-free vulnerabilities by employing memory poisoning with the following command: $ sudo grubby --info=ALL | grep args | grep -v init_on_free=1 If any output is returned, this is a finding. Check that page poisoning is enabled by default to persist in kernel updates with the following command: $ sudo grep grub_cmdline_linux /etc/default/grub GRUB_CMDLINE_LINUX="... init_on_free=1" If "init_on_free=1" is missing or commented out, this is a finding.

Fix Text (F-85769r1167058_fix)

Configure RHEL 10 to enable "init_on_free" with the following command: $ sudo grubby --update-kernel=ALL --args="init_on_free=1"