mediumsystemverified ✓
Disable virtual system calls in GRUB kernel parameters
grub-vsyscall-none · RHEL ≥ 8 · 1 impl
Description
The vsyscall=none kernel parameter must be set to disable the legacy virtual syscall mechanism. This prevents exploitation of the vsyscall page for return-oriented programming (ROP) attacks.
Rationale
The vsyscall page is at a fixed address and can be used as a gadget for ROP attacks. Disabling it eliminates this attack vector.
Check → Remediate
Checkgrub_parameter
- key:
- vsyscall
- expected:
- none
Remediategrub_parameter_set
- key:
- vsyscall
- value:
- none
Framework references
STIG
V-257792 / RHEL-09-212035V-230278V-281301 / RHEL-10-700990
NIST 800-53
CM-6SI-16
Live verification
rhel10:checkrhel8:checkrhel9:check
#grub#kernel#security#boot