OpenShift must prevent unauthorized and unintended information transfer via shared system resources and enable page poisoning.
An XCCDF Rule
Description
Enabling page poisoning in OpenShift improves memory safety, mitigates memory corruption vulnerabilities, aids in fault isolation, assists with debugging. It enhances the overall security and stability of the platform, reducing the risk of memory-related exploits and improving the resilience of applications running on OpenShift.
- ID
- SV-257548r961149_rule
- Version
- CNTR-OS-000560
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Apply the machine config to enable page poisoning by executing the following:
for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata: