How to Configure Linux Kernel ASLR (Address Space Layout Randomization)

The Threat of Memory Exploits

When a Linux server runs an application (like a web server or a database), the kernel loads the application’s executable code, its shared libraries, and its stack into physical RAM. Historically, these components were loaded into the exact same memory addresses every single time the application booted.

This predictability is a massive security vulnerability. If a hacker discovers a Buffer Overflow vulnerability in your web server, they can write a payload (like a reverse shell) and inject it into the RAM. Because the memory addresses are predictable, the hacker knows exactly where to point the CPU’s instruction pointer to execute their malicious payload (this is known as a Return-to-libc attack or ROP chaining).

To destroy this predictability, Linux utilizes ASLR (Address Space Layout Randomization). When ASLR is enabled, the kernel aggressively randomizes the memory locations of the stack, the heap, and the libraries every single time an application launches. If a hacker attempts a Buffer Overflow, their payload will jump to an empty, randomized section of RAM, causing a simple segmentation fault (a crash) rather than a full server compromise.

Verifying Current ASLR Status

You can check the current ASLR protection level of your Linux kernel by querying the sysctl virtual filesystem.

cat /proc/sys/kernel/randomize_va_space

Or alternatively:

sysctl -a | grep randomize_va_space

The kernel will return one of three integers:

• 0 : Disabled. The server is highly vulnerable.
• 1 : Conservative Randomization. Shared libraries, stack, mmap(), and VDSO are randomized. (The heap is not randomized).
• 2 : Full Randomization. Everything, including the heap (via brk()), is aggressively randomized. This is the enterprise standard.

Enabling Full ASLR via sysctl

If your server returns a 0 or a 1, you must immediately escalate it to full randomization.

To apply the protection immediately in RAM (without rebooting the server), execute the following command with root privileges:

sudo sysctl -w kernel.randomize_va_space=2

The moment you execute this, any new process spawned on the server will be subjected to full memory randomization.

Making the Protection Permanent

The sysctl -w command is volatile; the protection will revert to the default state if the server loses power or is rebooted.

To permanently harden the kernel, you must append the configuration to the primary system configuration file.

Open /etc/sysctl.conf using a text editor (like nano):

sudo nano /etc/sysctl.conf

Scroll to the very bottom of the file and add the following directive:

# Enforce Full Address Space Layout Randomization (ASLR)
kernel.randomize_va_space = 2

Save and close the file. To force the kernel to parse the file and apply the baseline immediately, execute:

sudo sysctl -p

The Caveat of PIE (Position Independent Executables)

It is important to understand that ASLR is a kernel-level feature, but it relies on the applications themselves being compiled correctly. For ASLR to fully randomize the base executable code of an application, that application must have been compiled by the developer with the PIE (Position Independent Executable) flag enabled in GCC.

Almost all modern software in Ubuntu/RHEL repositories is compiled with PIE, meaning your sysctl configuration provides absolute, comprehensive protection against memory corruption exploits.