Use zero for poisoning instead of debugging value
Requires the running kernel to be built with CONFIG_PAGE_POISONING_ZERO=y so freed pages are poisoned with zeros, avoiding redundant re-zeroing on allocation.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
By default page poisoning fills freed memory with a non-zero debug pattern (0xAA), which means pages must be zeroed again on allocation. CONFIG_PAGE_POISONING_ZERO=y poisons with zeros instead, so a freed page is already in the zeroed state the next allocation needs, this removes the redundant re-zeroing work, reducing the performance cost while still destroying any stale secrets in freed memory.
What Pavois checks
Pavois reads the build-time config of the running kernel via /boot/config-$(uname -r), falling back to /proc/config.gz, so the result reflects the booted kernel. Pavois expects CONFIG_PAGE_POISONING_ZERO=y.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_PAGE_POISONING_ZERO=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_PAGE_POISONING_ZERO=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_PAGE_POISONING_ZERO=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_PAGE_POISONING_ZERO='). Expected output: CONFIG_PAGE_POISONING_ZERO=y.
Inspect & investigate
This is a tuning sub-option with no dedicated log line. Confirm poisoning is active via dmesg | grep -i poison, journalctl -k and cat /proc/cmdline (look for page_poison=1).
Remediation
No automated remediation: CONFIG_PAGE_POISONING_ZERO is a kernel build-time option and cannot be set at runtime. It depends on CONFIG_PAGE_POISONING also being enabled. Note that newer kernels (5.11+) removed this option in favour of the unified init_on_free=1 mechanism. Use a distribution kernel that provides the relevant feature, or rebuild. Apply manually; pavois harden apply cannot change a compiled-in setting.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Poisoning with zeros is purely a performance optimisation of page poisoning; security is unchanged (freed secrets are still wiped). The only consequence of not setting it is slightly higher overhead. There is no runtime breakage risk or lockout concern. On kernels 5.11+ where the option was removed, prefer the init_on_free=1 boot parameter, which both zeroes freed memory and avoids the re-zeroing cost.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R17 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.