CME-101

ASLR (Address Space Layout Randomization)

Harden OS/Kernel Unquantified evidence Preventive

Description

Randomizes memory layout of processes, making memory corruption exploits significantly harder by requiring the attacker to guess or leak addresses.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Attacker must defeat randomization via info leak or brute force

CWE Relationships

CWE-119 CWE-120 CWE-122 CWE-787 CWE-125 CWE-416 CWE-415 CWE-824 CWE-825

Verification

Check kernel randomize_va_space sysctl is set to 2 (full randomization)

$ cat /proc/sys/kernel/randomize_va_space
# Expected: 2

Platform: linux

$ sysctl kernel.randomize_va_space
# Expected: kernel.randomize_va_space = 2

Platform: linux

$ (Get-ProcessMitigation -System).ASLR.ForceRelocateImages
# Expected: ON

Platform: windows

$ (Get-ProcessMitigation -System).ASLR.BottomUp
# Expected: ON

Platform: windows

Remediation

linux Enable full ASLR via sysctl with persistent drop-in


sysctl -w kernel.randomize_va_space=2
printf 'kernel.randomize_va_space = 2\n' > /etc/sysctl.d/99-cme-101-aslr.conf

windows Enable system-wide mandatory ASLR via Exploit Protection


Set-ProcessMitigation -System -Enable ForceRelocateImages
Set-ProcessMitigation -System -Enable BottomUp
Set-ProcessMitigation -System -Enable HighEntropy

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
redhat	enterprise_linux	`cpe:2.3:o:redhat:enterprise_linux:9:::::::` `cpe:2.3:o:redhat:enterprise_linux:8:::::::`	x86_64, aarch64, s390x, ppc64le	applicable
suse	sle-module-basesystem	`cpe:2.3:o:suse:sles:15:::::::*`	All	applicable
canonical	ubuntu_linux	`cpe:2.3:o:canonical:ubuntu_linux:24.04::::lts:::`	All	applicable
fedoraproject	fedora	`cpe:2.3:o:fedoraproject:fedora::::::::`	All	applicable
microsoft	windows	`cpe:2.3:o:microsoft:windows_10::::::::` `cpe:2.3:o:microsoft:windows_11::::::::` `cpe:2.3:o:microsoft:windows_server_2019:::::::` `cpe:2.3:o:microsoft:windows_server_2022:::::::`	All	applicable
apple	macos	`cpe:2.3:o:apple:macos::::::::`	All	applicable