Title

Amazon Linux 2023 must prevent the loading of a new kernel for later execution. (Cat II impact)

Discussion

Changes to any software components can have significant effects on the overall security of Amazon Linux 2023. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.

Check Content

Verify Amazon Linux 2023 is configured to disable kernel image loading. Check the status of the kernel.kexec_load_disabled kernel parameter with the following command: $ sudo sysctl kernel.kexec_load_disabled kernel.kexec_load_disabled = 1 If "kernel.kexec_load_disabled" is not set to "1" or is missing, this is a finding.

Fix Text

Configure Amazon Linux 2023 to disable kernel image loading. Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory: kernel.kexec_load_disabled = 1 Load settings from all system configuration files with the following command: $ sudo sysctl --system

Additional Identifiers

Rule ID: SV-274177r1120519_rule

Vulnerability ID: V-274177

Group Title: SRG-OS-000366-GPOS-00153

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.