OpenControls Logo

STIG Viewer

STIGViewer Support

RHEL 10 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time compiler.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-281337RHEL-10-800050SV-281337r1167161_ruleCCI-002824medium
Description
When hardened, the extended BPF just-in-time (JIT) compiler will randomize any kernel addresses in the BPF programs and maps, and will not expose the JIT addresses in "/proc/kallsyms".
STIGDate
Red Hat Enterprise Linux 10 Security Technical Implementation Guide2026-03-11

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
DCH-01Data Protection
1.00
IAC-21Least Privilege
1.00
SEA-10Memory Protection
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (14) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3(1)Additional Audit Information
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(2)Prevent Program Execution
1.00
SC-2Separation of System and User Functionality
1.00
SC-3Security Function Isolation
1.00
SC-39Process Isolation
1.00
SC-5Denial-of-service Protection
1.00

+4 more (top 10 by confidence shown)

CCI1 mapping
CCI-002824
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-10
1.00

Who does this work

7 NICE work roles and 7 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-281337r1167161_chk)

Verify RHEL 10 enables hardening for the BPF JIT compiler. Check the status of the "net.core.bpf_jit_harden" parameter with the following command: $ sudo sysctl net.core.bpf_jit_harden net.core.bpf_jit_harden = 2 If "net.core.bpf_jit_harden" is not equal to "2" or is missing, this is a finding.

Fix Text (F-85803r1167160_fix)

Configure RHEL 10 to enable hardening for the BPF JIT compiler. Create the drop-in file if it does not already exist: $ sudo vi /etc/sysctl.d/99-net_core-bpf_jit_harden.conf Add the following line to the file: net.core.bpf_jit_harden = 2 Reload settings from all system configuration files with the following command: $ sudo sysctl --system