Detections
Analytics

1.391 RHEL-10-701200

Information

RHEL 10 must disable the kdump service.

GROUP ID: V-281322RULE ID: SV-281322r1167116

Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition. Unless the system is used for kernel development or testing, there is little need to run the kdump service.

Solution

Configure RHEL 10 to disable and mask the kdump service.

To disable the kdump service, run the following command:

$ sudo systemctl disable --now kdump

Removed '/etc/systemd/system/multi-user.target.wants/kdump.service'.

To mask the kdump service, run the following command:

$ sudo systemctl mask --now kdump

Created symlink '/etc/systemd/system/kdump.service' ? '/dev/null'.

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-24, CAT|II, CCI|CCI-001665, Rule-ID|SV-281322r1167116_rule, STIG-ID|RHEL-10-701200, Vuln-ID|V-281322

Plugin: Unix

Control ID: 025eaf3da69d0bb67d4a0a45151ad7dbaccc6853db777dc13c3b14b172b20fb5