← Rules Catalog
lowsystemverified

Enable processor vulnerability mitigations in GRUB

grub-processor-mitigations · RHEL ≥ 8 · 1 impl

Description

The pti=on kernel parameter must be set to enable Kernel Page Table Isolation (KPTI) to mitigate processor-based vulnerabilities like Meltdown and Spectre.

Rationale

Modern processors have speculative execution vulnerabilities that can allow unauthorized access to kernel memory. KPTI separates kernel and user page tables to mitigate these attacks.

Check → Remediate

Checkgrub_parameter
key:
pti
expected:
on
Remediategrub_parameter_set
key:
pti
value:
on

Framework references

STIG

V-281304 / RHEL-10-701020V-257795 / RHEL-09-212050V-230491

NIST 800-53

CM-6SI-16

Live verification

rhel8:checkrhel9:check
#grub#kernel#security#cpu#meltdown#spectre#boot