STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

Red Hat Enterprise Linux CoreOS (RHCOS) must implement ASLR (Address Space Layout Randomization) from unauthorized code execution.

DISA Rule

SV-257569r961665_rule

Vulnerability Number

V-257569

Group Title

SRG-APP-000450-CTR-001105

Rule Version

CNTR-OS-000870

Severity

CAT II

CCI(s)

• CCI-002824 - Implement organization-defined controls to protect its memory from unauthorized code execution.

Weight

10

Fix Recommendation

Apply the machine config to implement ASLR by executing the following:

for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 75-sysctl-kernel-randomize-va-space-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
storage:
files:
- contents:
source: data:,kernel.randomize_va_space%3D2%0A
mode: 0644
path: /etc/sysctl.d/75-sysctl_kernel_randomize_va_space.conf
overwrite: true
" | oc apply -f -
done

Check Contents

Verify Red Hat Enterprise Linux CoreOS (RHCOS) implements ASLR by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; sysctl kernel.randomize_va_space
' 2>/dev/null; done

If "kernel.randomize_va_space" is not set to "2", this is a finding.

Vulnerability Number

V-257569

Documentable

False

Rule Version

CNTR-OS-000870

Severity Override Guidance

Verify Red Hat Enterprise Linux CoreOS (RHCOS) implements ASLR by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; sysctl kernel.randomize_va_space
' 2>/dev/null; done

If "kernel.randomize_va_space" is not set to "2", this is a finding.

Check Content Reference

M

Target Key

5547