lowsystemverified ✓
Enable processor vulnerability mitigations in GRUB
grub-processor-mitigations · RHEL ≥ 8 · 1 impl
Description
The pti=on kernel parameter must be set to enable Kernel Page Table Isolation (KPTI) to mitigate processor-based vulnerabilities like Meltdown and Spectre.
Rationale
Modern processors have speculative execution vulnerabilities that can allow unauthorized access to kernel memory. KPTI separates kernel and user page tables to mitigate these attacks.
Check → Remediate
Checkgrub_parameter
- key:
- pti
- expected:
- on
Remediategrub_parameter_set
- key:
- pti
- value:
- on
Framework references
STIG
V-281304 / RHEL-10-701020V-257795 / RHEL-09-212050V-230491
NIST 800-53
CM-6SI-16
Live verification
rhel8:checkrhel9:check
#grub#kernel#security#cpu#meltdown#spectre#boot