ASLR Disabled Via Sysctl or Direct Syscall - Linux (e497a24e-9345-4a62-9803-b06d7d7cb132)
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use of the personality syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
- Modification of the /proc/sys/kernel/randomize_va_space file
- Execution of the sysctl command to set kernel.randomize_va_space=0
Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.
A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.