← Back to Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide

V-257548

CAT II (Medium)

OpenShift must prevent unauthorized and unintended information transfer via shared system resources and enable page poisoning.

Rule ID

SV-257548r961149_rule

STIG

Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-001090

Discussion

Enabling page poisoning in OpenShift improves memory safety, mitigates memory corruption vulnerabilities, aids in fault isolation, assists with debugging. It enhances the overall security and stability of the platform, reducing the risk of memory-related exploits and improving the resilience of applications running on OpenShift.

Check Content

Check the current CoreOS boot loader configuration has page poisoning enabled by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME ";  grep page_poison /boot/loader/entries/*.conf|| echo "not found"' 2>/dev/null; done

If "page_poison" is not set to "1" or returns "not found", this is a finding.

Fix Text

Apply the machine config to enable page poisoning by executing the following:

for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 05-kernelarg-page-poison-$mcpool
  labels:
    machineconfiguration.openshift.io/role: $mcpool
spec:
  config:
    ignition:
      version: 3.1.0
  kernelArguments:
  - page_poison=1
" | oc apply -f -
done