{
  "id": "CB-UBU-BOOT-014",
  "standard": "ubuntu",
  "version": "0.1.0",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-014",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-014.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-014.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-BOOT-014",
    "title": "Remove prelink",
    "finding": {
      "title": "prelink is installed",
      "description": "prelink rewrites system binaries and libraries, which defeats address randomization of libraries and breaks file integrity checks."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "package",
      "memory",
      "integrity"
    ],
    "description": "`prelink` modifies ELF binaries and shared libraries in place so that libraries load at fixed,\nprecomputed addresses, to save a little time at program start. It is in the `universe`\ncomponent of Ubuntu up to 24.04 and is no longer in the archive from 26.04.\n",
    "rationale": "Prelinked libraries always load at the same address, which removes part of the benefit of\naddress space layout randomization (CB-UBU-BOOT-001). Prelink also rewrites binaries on a\nschedule, so file integrity tools such as AIDE report changes that are not attacks, which\ntrains administrators to ignore their alerts. The startup gain is negligible on current\nhardware.\n",
    "impact": "None known. Before removal, the fix runs `prelink -ua` to restore every binary to its original\ncontent, which can take a few minutes on a large system.\n",
    "notes": "On 26.04 the package cannot be installed from the archive, so the check passes unless it came\nfrom another source.\n",
    "setting": {
      "location": "Package `prelink`",
      "default_value": "Not installed",
      "recommended_value": "Not installed"
    },
    "audit": {
      "manual": "Run `dpkg -s prelink`. The package must not be installed.\n",
      "checks": [
        {
          "id": "package",
          "engine": "package",
          "description": "The prelink package is not installed.",
          "spec": {
            "name": "prelink",
            "state": "absent"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Restore the original binaries: `prelink -ua`.\n2. Remove the package: `apt purge prelink`.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Reinstall the package with `apt install prelink`; binaries are prelinked again at the next\nrun of its daily job.\n",
      "scripts": [
        {
          "id": "undo-and-purge",
          "engine": "shell",
          "content": "if command -v prelink >/dev/null 2>&1; then\n  prelink -ua || { echo 'prelink -ua failed, package kept' >&2; exit 1; }\nfi\nDEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=300 purge -y -q prelink\n"
        }
      ]
    },
    "references": [
      {
        "title": "prelink(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/prelink.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu Security documentation - Address space layout randomization",
        "url": "https://documentation.ubuntu.com/security/security-features/process-memory/aslr/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1068"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-BOOT-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot",
        "notes": "Passes on a fresh install; with prelink installed and run (prelink -avmR) it fails, the fix runs prelink -ua and purges the package, then it passes."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot",
        "notes": "Passes on a fresh install; with prelink installed and run (prelink -avmR) it fails, the fix runs prelink -ua and purges the package, then it passes."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "Passes on a fresh install; with prelink installed and run (prelink -avmR) it fails, the fix runs prelink -ua and purges the package, then it passes."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "Passes on a fresh install; prelink is not in the 26.04 archive."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}