Description
The kernel.randomize_va_space sysctl controls address space layout randomization (ASLR).
With the value 2, the kernel randomizes the positions of the stack, the virtual dynamic
shared object page, shared memory regions and the data segment (heap) of every process.
1 randomizes everything except the heap, 0 disables ASLR. A program that needs ASLR off
for debugging can be started with setarch -R instead of changing the system setting.
Rationale
Most memory corruption exploits need to know the address of the code or data they target. Randomizing the layout at every execution turns a reliable exploit into a guess, and makes return-oriented programming much harder.
Impact
None known. 2 is the kernel default and the Debian default.
Setting
| Location | sysctl `kernel.randomize_va_space`, persisted in `/etc/sysctl.d/` |
| Default | 2 |
| Recommended | 2 |
Audit
Run sysctl kernel.randomize_va_space. The value must be 2.
Then check that no file in /etc/sysctl.conf, /etc/sysctl.d/, /run/sysctl.d/
or /usr/lib/sysctl.d/ sets it to another value.
Automated: every check must pass. Scanners report each check by its id.
running
Running value of kernel.randomize_va_space.
key: kernel.randomize_va_space
value: 2
Remediation
Create /etc/sysctl.d/60-cirsec.conf containing kernel.randomize_va_space = 2,
remove any other assignment of this key, then run sysctl --system.
| Restart | none |
| Disruption | none |
Rollback
Remove the line from /etc/sysctl.d/60-cirsec.conf and run sysctl --system.
set
Generated from check running: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- Linux kernel documentation - Documentation for /proc/sys/kernel/ (randomize_va_space) The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R9) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R9 | partial | R9 lists several kernel settings; this control covers kernel.randomize_va_space. |
| NIST SP 800-53 Rev. 55.1.1 | SC-30 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Generated check, fix and check again for profiles core and server-hardened; values kept after reboot; fix idempotent. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Generated check, fix and check again for profiles core and server-hardened; values kept after reboot; fix idempotent. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |