SV-257795r1044845: RHEL 9 must enable mitigations against processor-based vulnerabilities. | Red Hat Enterprise Linux 9 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 9 must enable mitigations against processor-based vulnerabilities.

Description

Discussion Text

Kernel page-table isolation is a kernel feature that mitigates the Meltdown security vulnerability and hardens the kernel against attempts to bypass kernel address space layout randomization (KASLR). Satisfies: SRG-OS-000433-GPOS-00193, SRG-OS-000095-GPOS-00049

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000381Not mappedCCI-002824

References

DPMS Target Red Hat Enterprise Linux 9 DISA DPMS Target Red Hat Enterprise Linux 9 5551

Checks

DISA STIG (Manual Reference)

Verify RHEL 9 enables kernel page-table isolation with the following command:

$ sudo grubby --info=ALL | grep args | grep -v 'pti=on'

If any output is returned, this is a finding.

Check that kernel page-table isolation is enabled by default to persist in kernel updates: 

$ grep pti /etc/default/grub

GRUB_CMDLINE_LINUX="pti=on"

If "pti" is not set to "on", is missing or commented out, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel9os:def:257795
# RHEL 9 must enable mitigations against processor-based vulnerabilities.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# textfilecontent54_object (textfilecontent54_test)
test_1() {
  (grep -rhP --include='*.conf' '^options\s+(.*)$' '/boot/loader/entries' | sed -En 's/^options\s+(.*)$/\1/p') | grep -Pq '(^|\s)pti=on(\s|$)'
}
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^GRUB_CMDLINE_LINUX="(.*)"/\1/p' '/etc/default/grub') | grep -Pq '(^|\s)pti=on(\s|$)'
}

if ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL definition: oval:mil.disa.stig.rhel9os:def:257795
if ! grep -qE "(^|\\s)pti=on(\\s|$)" /boot/loader/entries/default.conf; then echo "FAIL"; exit 1; fi
if ! grep -qE "(^|\\s)pti=on(\\s|$)" /etc/default/grub; then echo "FAIL"; exit 1; fi
echo "PASS"
exit 0

Remediation

Configure RHEL 9 to enable kernel page-table isolation with the following command:

$ sudo grubby --update-kernel=ALL --args="pti=on"

Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates:

GRUB_CMDLINE_LINUX="pti=on"