Navigate

Check: AZLX-23-002585

Amazon Linux 2023 STIG: AZLX-23-002585 (in version v1 r1)

Title

Amazon Linux 2023 must mount /dev/shm with the nodev option. (Cat II impact)

Discussion

The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.

Check Content

Verify Amazon Linux 2023 is configured so that "/dev/shm" is mounted with the "nodev" option with the following command: $ mount | grep /dev/shm tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel) If the /dev/shm file system is mounted without the "nodev" option, this is a finding.

Fix Text

Configure Amazon Linux 2023 so that "/dev/shm" is mounted with the "nodev" option. Modify "/etc/fstab" to use the "nodev" option on the "/dev/shm" file system.

Additional Identifiers

Rule ID: SV-274179r1120525_rule

Vulnerability ID: V-274179

Group Title: SRG-OS-000368-GPOS-00154

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001764	Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
CM-7(2)	Prevent Program Execution