CME-502
noexec on /tmp and /dev/shm
Description
Mounts /tmp and /dev/shm with noexec option, preventing execution of attacker-dropped binaries or scripts from temporary directories commonly used as staging areas.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Attacker cannot execute payloads from common writable directories |
CWE Relationships
Verification
Check mount options for /tmp and /dev/shm
$ mount | grep '/tmp' | grep noexec
# Expected: noexec
# Expected: noexec
Platform: linux
$ mount | grep '/dev/shm' | grep noexec
# Expected: noexec
# Expected: noexec
Platform: linux
Remediation
linux
Mount /tmp and /dev/shm with noexec,nosuid,nodev options
mount -o remount,noexec,nosuid,nodev /tmp
mount -o remount,noexec,nosuid,nodev /dev/shm
grep -q '[[:space:]]/tmp[[:space:]]' /etc/fstab && sed -i '/[[:space:]]/tmp[[:space:]]/ s/defaults/defaults,noexec,nosuid,nodev/' /etc/fstab || echo 'tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev 0 0' >> /etc/fstab
grep -q '[[:space:]]/dev/shm[[:space:]]' /etc/fstab && sed -i '/[[:space:]]/dev/shm[[:space:]]/ s/defaults/defaults,noexec,nosuid,nodev/' /etc/fstab || echo 'tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0' >> /etc/fstab