CME-104

KASLR (Kernel Address Space Layout Randomization)

Harden OS/Kernel Unquantified evidence Preventive

Description

Randomizes the kernel base address at each boot, making kernel exploits harder by requiring address leaks to locate kernel functions and data structures.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Kernel exploit must include info leak to locate kernel symbols

CWE Relationships

CWE-119 CWE-269

Verification

Verify KASLR is not disabled in boot parameters

$ cat /proc/cmdline | grep -v nokaslr && echo 'KASLR active'
# Expected: KASLR active

Platform: linux

$ dmesg | grep 'KASLR'
# Expected: KASLR enabled

Platform: linux

Remediation

linux Ensure KASLR is active by removing nokaslr from GRUB boot parameters


sed -i 's/ *nokaslr//g' /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg