Detections
Analytics

1.342 ALMA-09-044680

Information

AlmaLinux OS 9 must enable mitigations against processor-based vulnerabilities.

GROUP ID: V-269450
RULE ID: SV-269450r1050333

Kernel page-table isolation is a kernel feature that mitigates the Meltdown security vulnerability and hardens the kernel against attempts to bypass kernel address space layout randomization (KASLR).

Solution

Configure AlmaLinux OS 9 to enable kernel page-table isolation with the following command:

$ grubby --update-kernel=ALL --args="pti=on"

Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates:

GRUB_CMDLINE_LINUX="pti=on"

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16, CCI|CCI-002824, Rule-ID|SV-269450r1050333_rule, STIG-ID|ALMA-09-044680, Vuln-ID|V-269450

Plugin: Unix

Control ID: 9d861e2b43339a2a9b6640125c9d11990d91763c8be805430e7b08e0c136ca9a