Title

Ubuntu OS must restrict access to the kernel message buffer. (Cat II impact)

Discussion

Restricting access to the kernel message buffer limits access only to root. This prevents attackers from gaining additional system information as a nonprivileged user.

Check Content

Verify Ubuntu OS is configured to restrict access to the kernel message buffer by using the following command: $ sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding. Verify there are no configurations that enable the kernel dmesg function: $ sudo grep -ir kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null /etc/sysctl.d/10-kernel-hardening.conf:kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.

Fix Text

Configure Ubuntu OS to restrict access to the kernel message buffer. Add or modify the following line in the "/etc/sysctl.conf" file: kernel.dmesg_restrict = 1 Remove any configurations that conflict with the above from the following locations: /run/sysctl.d/ /etc/sysctl.d/ /usr/local/lib/sysctl.d/ /usr/lib/sysctl.d/ /lib/sysctl.d/ /etc/sysctl.conf Reload settings from all system configuration files by using the following command: $ sudo sysctl --system Note: This is set by default as part of the NetIM Ubuntu baseline.

Additional Identifiers

Rule ID: SV-275567r1147751_rule

Vulnerability ID: V-275567

Group Title: SRG-OS-000138-GPOS-00069

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.