Detections
Analytics

1.311 OL09-00-002409

Information

OL 9 must disable access to network bpf system call from nonprivileged processes.

GROUP ID: V-271748
RULE ID: SV-271748r1117266

Loading and accessing the packet filters programs and maps using the bpf() system call has the potential of revealing sensitive information about the kernel state.

Solution

Configure OL 9 to prevent privilege escalation thru the kernel by disabling access to the bpf syscall by adding the following line to a file, in the "/etc/sysctl.d" directory:

kernel.unprivileged_bpf_disabled = 1

The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command:

$ sudo sysctl --system

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-2, CCI|CCI-001082, Rule-ID|SV-271748r1117266_rule, STIG-ID|OL09-00-002409, Vuln-ID|V-271748

Plugin: Unix

Control ID: 0f6472e8b5343e947f50287936ee1955765697c9deb858d68fc4805791e9f4a3