Detections
Analytics

1.404 RHEL-10-800030

Information

RHEL 10 must disable access to the network bpf system call from nonprivileged processes.

GROUP ID: V-281335RULE ID: SV-281335r1167155

Loading and accessing the packet filters programs and maps using the bpf() system call has the potential to reveal sensitive information about the kernel state.

Solution

Configure RHEL 10 to prevent privilege escalation through the kernel by disabling access to the bpf system call.

Create the drop-in file if it does not already exist:

$ sudo vi /etc/sysctl.d/99-kernel_unprivileged_bpf_disabled

Add the following line to the file:

kernel.unprivileged_bpf_disabled = 1

Reload settings from all system configuration files with the following command:

$ sudo sysctl --system

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-2, CAT|II, CCI|CCI-001082, Rule-ID|SV-281335r1167155_rule, STIG-ID|RHEL-10-800030, Vuln-ID|V-281335

Plugin: Unix

Control ID: 0ae60e3f8b3817afaa7ba8b6d2e80a6c6af0e1a89878d4992aacf2f7b77cd47a