1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
documentation_complete: true
title: 'Disable vsyscalls'
description: |-
To disable use of virtual syscalls,
add the argument <tt>vsyscall=none</tt> to the default
GRUB 2 command line for the Linux operating system.
{{{ describe_grub2_argument("vsyscall=none") | indent(4) }}}
rationale: |-
Virtual Syscalls provide an opportunity of attack for a user who has control
of the return instruction pointer.
severity: medium
identifiers:
cce@rhel8: CCE-80946-7
cce@rhel9: CCE-83842-5
cce@rhel10: CCE-87153-3
references:
nist: CM-7(a)
ospp: FPT_ASLR_EXT.1
srg: SRG-OS-000480-GPOS-00227,SRG-OS-000134-GPOS-00068
stigid@ol8: OL08-00-010422
ocil_clause: 'vsyscalls are enabled'
ocil: |-
{{{ ocil_grub2_argument("vsyscall=none") | indent(4) }}}
platform: x86_64_arch
template:
name: grub2_bootloader_argument
vars:
arg_name: vsyscall
arg_value: none
fixtext: |-
{{{ describe_grub2_argument("vsyscall=none") | indent(4) }}}
srg_requirement:
{{{ full_name }}} must disable virtual syscalls.
warnings:
- general: |-
The vsyscall emulation is only available on x86_64 architecture
(CONFIG_X86_VSYSCALL_EMULATION) making this rule not applicable
to other CPU architectures.
|
