The operating system must verify remote disconnection at the termination of nonlocal maintenance and diagnostic sessions, when used for nonlocal maintenance sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-203738	SRG-OS-000395-GPOS-00175	SV-203738r958852_rule	CCI-002891	medium
Description
If the remote connection is not closed and verified as closed, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Remote connections must be disconnected and verified as disconnected when nonlocal maintenance sessions have been terminated and are no longer available for use.
STIG			Date
General Purpose Operating System Security Requirements Guide			2024-12-04

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MNT-05.4Remote Maintenance Disconnect Verification

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (11) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-12Session Termination

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(8)Access to Accounts — Replay Resistant

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-5(1)Password-based Authentication

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-7Cryptographic Module Authentication

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

MA-4Nonlocal Maintenance

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

MA-4(7)Disconnect Verification

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-10Network Disconnect

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-23(1)Invalidate Session Identifiers at Logout

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+1 more (top 10 by confidence shown)

CCI1 mapping

CCI-002891

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)

Details

Check Text (C-203738r958852_chk)

Verify the operating system verifies remote disconnection at the termination of nonlocal maintenance and diagnostic sessions, when used for nonlocal maintenance sessions. If it does not, this is a finding.

Fix Text (F-3863r375279_fix)

Configure the operating system to verify remote disconnection at the termination of nonlocal maintenance and diagnostic sessions, when used for nonlocal maintenance sessions.