Skip to content
ATO Pathways
  Log In

System Must Avoid Meltdown and Spectre Exploit Vulnerabilities in Modern Processors

An XCCDF Rule

Description

Verify that Meltdown mitigations are not disabled: 

$ sudo grubby --info=ALL | grep mitigations
The mitigations must not be set to "off".

Rationale

Hardware vulnerabilities allow programs to steal data that is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to obtain secrets stored in the memory of other running programs. This might include passwords stored in a password manager or browser; personal photos, emails, and instant messages; and business-critical documents.

ID
xccdf_org.ssgproject.content_rule_grub2_mitigation_argument
Severity
Medium
References
Updated



Remediation - Ansible

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL08-00-010424
  - NIST-800-53-CM-6(b)

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common; then

grubby --update-kernel=ALL --remove-args=mitigations=off --env=/boot/grub2/grubenv

else