Title

The system must not apply reversed source routing to TCP responses. (Cat II impact)

Discussion

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.

Check Content

Check the reverse source route settings for the system: # sysctl net.ipv4.conf.all.accept_source_route # sysctl net.ipv4.conf.default.accept_source_route If either setting has a value other than zero, this is a finding.

Fix Text

Add the entries in /etc/sysctl.conf to disable reverse source routing: # printf "sysctl net.ipv4.conf.all.accept_source_route = 0\n" >> /etc/sysctl.conf # printf "sysctl net.ipv4.conf.default.accept_source_route = 0\n" >> /etc/sysctl.conf Activate the updated settings: # /sbin/sysctl -p /etc/sysctl.conf

Additional Identifiers

Rule ID: SV-46156r1_rule

Vulnerability ID: V-22412

Group Title: GEN003605

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.