Detections
Analytics

1.382 RHEL-10-701110

Information

RHEL 10 must disable the Stream Control Transmission Protocol (SCTP) kernel module.

GROUP ID: V-281313
RULE ID: SV-281313r1184770

It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore, may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

Failing to disconnect unused protocols can result in a system compromise.

The SCTP is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. Disabling SCTP protects the system against exploitation of any flaws in its implementation.

Solution

Configure RHEL 10 to disable the ability to load the sctp kernel module.

Create a drop-in if it does not already exist:

$ sudo vi /etc/modprobe.d/sctp.conf

Add the following lines to the file:

install sctp /bin/falseblacklist sctp

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-281313r1184770_rule, STIG-ID|RHEL-10-701110, Vuln-ID|V-281313

Plugin: Unix

Control ID: 0d348b6ff489862bb212e8c19bfd5f0fa8e62ba8ed9629d541d35e6bfe4fca8e