cyberstrikeus CIS 1.4 — Disable downwardMetrics feature gate
Profile Applicability
- Level 1
Description
The downwardMetrics feature allows users to collect and monitor additional metrics related to host and virtual machine performance.
Rationale
Enabling the downwardMetrics feature introduces the risk of unauthorized or unintended sharing of information, as well as manipulation of information flow restrictions. The additional metrics include sensitive performance data, which could aid in the reconnaissance activities of a malicious actor.
Impact
Guests are not able to use the host metrics.
Audit Procedure
Check the downwardMetrics feature gate is disabled:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -ojsonpath='{.spec.featureGates.downwardMetrics}'
Verify the output is false.
Remediation
Set downwardMetrics to False:
$ oc patch hyperconverged kubevirt-hyperconverged -n openshift-cnv --type='json' -p='[
{"op": "replace", "path": "/spec/featureGates/downwardMetrics", "value": false },
]'
Default Value
By default, the downwardMetrics is set to false.
References
- CIS Redhat OpenShift Virtual Machine Extension Benchmark v1.0.0, Section 1.4
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.2 Collect Audit Logs | Y | Y | Y |
| v8 | 8.3 Ensure Adequate Audit Log Storage | Y | Y | Y |
| v7 | 6.3 Enable Detailed Logging | N | Y | Y |
| v7 | 14.9 Enforce Detail Logging for Access or Changes to Sensitive Data | N | N | Y |
MITRE ATT&CK Mappings
| Tactic | Technique |
|---|---|
| Discovery | T1082 System Information Discovery |
| Reconnaissance | T1592 Gather Victim Host Information |
Profile
- Level 1 - OpenShift Virtualization