V-285679

Discussion

Some adversaries launch attacks with the intent of executing code in nonexecutable regions of memory or in memory locations that are prohibited. Security safeguards employed to protect memory include, for example, data execution prevention and address space layout randomization. Data execution prevention safeguards can either be hardware-enforced or software-enforced with hardware providing the greater strength of mechanism. Examples of attacks are buffer overflow attacks.

Check Content

Validate protection of the STIG sysctl configuration file and active kernel runtime settings.

Verify Harvester Government enforces approved kernel security parameters and protects system configuration settings from unauthorized modification.

1. Access Harvester Government using a privileged account and verify the STIG system configuration file exists and is protected:

stat -c "%n %a %U %G" /etc/sysctl.d/99-stig.conf

2. Verify the output returns:

/etc/sysctl.d/99-stig.conf 600 root root

If /etc/sysctl.d/99-stig.conf does not exist, is not owned by root:root, or has permissions more permissive than 600, this is a finding.

3. Review the active kernel security parameters:

grep -E "(vm.panic_on_oom|vm.overcommit_memory|kernel.panic|kernel.panic_on_oops|kernel.kptr_restrict|kernel.randomize_va_space|kernel.dmesg_restrict)" /etc/sysctl.d/99-stig.conf

4. Verify the output reflects:

vm.panic_on_oom = 0
vm.overcommit_memory = 1
kernel.panic = 10
kernel.panic_on_oops = 1
kernel.kptr_restrict = 1
kernel.randomize_va_space = 2
kernel.dmesg_restrict = 1

(out-of-memory handling behavior is configured according to the approved baseline;
memory allocation behavior is controlled;
the kernel automatically responds to panic conditions;
kernel oops events trigger panic handling;
kernel pointer exposure is restricted;
Address Space Layout Randomization [ASLR] is enabled;
kernel message access is restricted.)

If any required kernel parameter is absent, unavailable, or configured with values other than the approved baseline, this is a finding.