Detections
Analytics

1.46 SLES-15-010375

Information

The SUSE operating system must restrict access to the kernel message buffer.

GROUP ID: V-255921
RULE ID: SV-255921r958524

Restricting access to the kernel message buffer limits access only to root. This prevents attackers from gaining additional system information as a nonprivileged user.

Solution

Configure the operating system to restrict access to the kernel message buffer.

Set the system to the required kernel parameter by adding or modifying the following line in /etc/sysctl.conf or a config file in the /etc/sysctl.d/ directory:

kernel.dmesg_restrict = 1

Remove any configurations that conflict with the above from the following locations:

/run/sysctl.d/
/etc/sysctl.d/
/usr/local/lib/sysctl.d/
/usr/lib/sysctl.d/
/lib/sysctl.d/
/etc/sysctl.conf

Reload settings from all system configuration files with the following command:

$ sudo sysctl --system

See Also

https://workbench.cisecurity.org/benchmarks/23779

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-4, CAT|III, CCI|CCI-001090, Rule-ID|SV-255921r958524_rule, STIG-ID|SLES-15-010375, Vuln-ID|V-255921

Plugin: Unix

Control ID: a1b286fea395898e4e8449acee2f95e2316c056ddfbdc33bd2888ba26cdde5b4