Enable poison of pages after freeing
Requires the running kernel to be built with CONFIG_PAGE_POISONING=y so freed memory pages are overwritten, destroying stale data.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When memory is freed, its contents remain in RAM until reused. If that memory previously held secrets (keys, passwords, tokens), a later use-after-free bug or a fresh allocation that reads stale data can leak it. CONFIG_PAGE_POISONING=y overwrites freed pages with a known pattern, so stale sensitive data is destroyed and use-after-free conditions are easier to detect and harder to exploit.
What Pavois checks
Pavois reads the build-time config of the running kernel via /boot/config-$(uname -r), falling back to /proc/config.gz, so the result reflects the booted kernel. Pavois expects CONFIG_PAGE_POISONING=y.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_PAGE_POISONING=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_PAGE_POISONING=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_PAGE_POISONING=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_PAGE_POISONING='). Expected output: CONFIG_PAGE_POISONING=y. On many kernels poisoning is built in but gated by the page_poison=1 boot parameter, check cat /proc/cmdline.
Inspect & investigate
When enabled, the kernel logs mem auto-init: stack:..., heap alloc:..., heap free:... style messages at boot; check dmesg | grep -i poison and journalctl -k. Active boot-time toggles appear in cat /proc/cmdline.
Remediation
No automated remediation: CONFIG_PAGE_POISONING is a kernel build-time option. It cannot be enabled at runtime, it requires a kernel compiled with the option (and often the page_poison=1 kernel command-line parameter to activate it). Use a distribution kernel that provides it, or rebuild. Apply manually; pavois harden apply cannot change a compiled-in setting.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without page poisoning, freed memory keeps stale secrets that can leak through bugs. Enabling it has a measurable performance cost (every freed page is rewritten), which is why CONFIG_PAGE_POISONING_NO_SANITY and _ZERO exist to tune it. Precaution: on latency-sensitive or high-throughput workloads, measure the overhead before enabling broadly, and prefer activating via page_poison=1 on the command line so it can be rolled back with a single boot-parameter change.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R17 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.