Do not allow usercopy whitelist violations to fallback to object size
An XCCDF Rule
Description
This is a temporary option that allows missing usercopy whitelists to be discovered via a WARN()
to the kernel log, instead of rejecting the copy, falling back to non-whitelisted hardened
usercopy that checks the slab allocation size instead of the whitelist size.
This configuration is available from kernel 4.16.
The configuration that was used to build kernel is available at /boot/config-*.
To check the configuration value for CONFIG_HARDENED_USERCOPY_FALLBACK, run the following command:
grep CONFIG_HARDENED_USERCOPY_FALLBACK /boot/config-*
Configs with value 'n' are not explicitly set in the file, so either commented lines or no
lines should be returned.
warning alert: Warning
Rationale
This config prevents entire classes of heap overflow exploits and similar kernel memory exposures.
- ID
- xccdf_org.ssgproject.content_rule_kernel_config_hardened_usercopy_fallback
- Severity
- High
- References
- Updated