CME-104
KASLR (Kernel Address Space Layout Randomization)
Description
Randomizes the kernel base address at each boot, making kernel exploits harder by requiring address leaks to locate kernel functions and data structures.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Kernel exploit must include info leak to locate kernel symbols |
CWE Relationships
Verification
Verify KASLR is not disabled in boot parameters
$ cat /proc/cmdline | grep -v nokaslr && echo 'KASLR active'
# Expected: KASLR active
# Expected: KASLR active
Platform: linux
$ dmesg | grep 'KASLR'
# Expected: KASLR enabled
# Expected: KASLR enabled
Platform: linux