OpenControls Logo

STIG Viewer

STIGViewer Support

AlmaLinux OS 9 must restrict exposed kernel pointer addresses access.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269423ALMA-09-040830SV-269423r1198253_ruleCCI-001082medium
Description
Exposing kernel pointers (through procfs or "seq_printf()") exposes kernel writeable structures, which may contain functions pointers. If a write vulnerability occurs in the kernel, allowing write access to any of this structure, the kernel can be compromised. This option disallows any program without the CAP_SYSLOG capability to get the addresses of kernel pointers by replacing them with "0".
STIGDate
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide2026-05-22

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SEA-03.2Application Partitioning
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (19) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3Access Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AU-9Protection of Audit Information
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-5(3)Signed Components
1.00
CM-5(6)Limit Library Privileges
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-5(2)Public Key-based Authentication
1.00
SC-2Separation of System and User Functionality
1.00

+9 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.3
1.00
CCI1 mapping
CCI-001082
1.00

Details

Check Text (C-269423r1198253_chk)

Verify the runtime status of the kernel.kptr_restrict kernel parameter with the following command: $ sysctl kernel.kptr_restrict kernel.kptr_restrict = 1 Verify the configuration of the kernel.kptr_restrict kernel parameter with the following command: $ /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F kernel.kptr_restrict | tail -1 kernel.kptr_restrict =1 If "kernel.kptr_restrict" is not set to "1" or is missing, this is a finding.

Fix Text (F-73355r1049680_fix)

Configure AlmaLinux OS 9 to restrict exposed kernel pointer addresses access with the following command: $ echo "kernel.kptr_restrict = 1" > /etc/sysctl.d/60-kptr.conf Load settings from all system configuration files with the following command: $ sysctl --system