mediumsystemverified ✓
Enable SLUB debug poisoning in GRUB kernel parameters
grub-slub-debug · RHEL ≥ 9 · 1 impl
Description
The slub_debug=P kernel parameter must be set to enable SLUB allocator poisoning. This clears freed memory to prevent use-after-free attacks.
Rationale
SLUB poisoning fills freed memory with a poison value, making it harder for attackers to exploit use-after-free vulnerabilities by corrupting stale object data.
Check → Remediate
Checkgrub_parameter
- key:
- slub_debug
- expected:
- P
Remediategrub_parameter_set
- key:
- slub_debug
- value:
- P
Framework references
NIST 800-53
CM-6SC-4
Live verification
rhel9:check
#grub#kernel#memory#security#boot