OL 9 must require users to reauthenticate for privilege escalation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-271724	OL09-00-002362	SV-271724r1091884_rule	CCI-002234	medium
Description
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate.
STIG			Date
Oracle Linux 9 Security Technical Implementation Guide			2026-02-17

Related Frameworks

1 mapping across 4 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-21.4Auditing Use of Privileged Functions

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(1)Automated System Account Management

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)DISA STIG Benchmark (XCCDF)V3R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)DISA STIG Benchmark (XCCDF)V3R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(4)Automated Audit Actions

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-3Access Enforcement

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-4Information Flow Enforcement

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-6(8)Privilege Levels for Code Execution

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-6(9)Log Use of Privileged Functions

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-10Non-repudiation

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-12Audit Record Generation

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-12(3)Changes by Authorized Individuals

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+24 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.7

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
NIST SP 800-171 Rev 2, Appendix DRev 2 (Feb 2020, errata Jan 2021)equal to(normalised)

CCI1 mapping

CCI-002234

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)

Details

Check Text (C-271724r1091884_chk)

Verify that OL 9 requires users to reauthenticate for privilege escalation. Verify that "/etc/sudoers" has no occurrences of "!authenticate" with the following command: $ sudo grep -ri '!authenticate' /etc/sudoers /etc/sudoers.d/* If any occurrences of "!authenticate" are returned, this is a finding.

Fix Text (F-75681r1091883_fix)

Configure OL 9 to not allow users to execute privileged actions without authenticating. Remove any occurrence of "!authenticate" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory. $ sudo sed -i '/\!authenticate/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*