OpenControls Logo

STIG Viewer

STIGViewer Support

RHEL 9 must disable virtual system calls.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-257792RHEL-09-212035SV-257792r1044842_ruleCCI-001084medium
Description
System calls are special routines in the Linux kernel, which userspace applications ask to do privileged tasks. Invoking a system call is an expensive operation because the processor must interrupt the currently executing task and switch context to kernel mode and then back to userspace after the system call completes. Virtual system calls map into user space a page that contains some variables and the implementation of some system calls. This allows the system calls to be executed in userspace to alleviate the context switching expense. Virtual system calls provide an opportunity of attack for a user who has control of the return instruction pointer. Disabling virtual system calls help to prevent return oriented programming (ROP) attacks via buffer overflows and overruns. If the system intends to run containers based on RHEL 6 components, then virtual system calls will need enabled so the components function properly. Satisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000134-GPOS-00068
STIGDate
Red Hat Enterprise Linux 9 Security Technical Implementation Guide2025-05-14

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

END-16Restrict Access To Security Functions
0.50
SEA-04.1Security Function Isolation
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (29) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-3Access Enforcement
1.00
AC-3(13)Attribute-based Access Control
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(8)Privilege Levels for Code Execution
1.00

+19 more (top 10 by confidence shown)

CCI1 mapping
CCI-001084
1.00

Details

Check Text (C-257792r1044842_chk)

Verify the current GRUB 2 configuration disables virtual system calls with the following command: $ sudo grubby --info=ALL | grep args | grep -v 'vsyscall=none' If any output is returned, this is a finding. Check that virtual system calls are disabled by default to persist in kernel updates with the following command: $ sudo grep vsyscall /etc/default/grub GRUB_CMDLINE_LINUX="vsyscall=none" If "vsyscall" is not set to "none", is missing or commented out, and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix Text (F-61457r925362_fix)

Document the use of virtual system calls with the ISSO as an operational requirement or disable them with the following command: $ sudo grubby --update-kernel=ALL --args="vsyscall=none" Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates: GRUB_CMDLINE_LINUX="vsyscall=none"