cyberstrikeus CIS 1.7 — Ensure KSM is disabled
Profile Applicability
- Level 2
Description
Kernel Samepage Merging (KSM) is a Linux kernel feature that merges identical memory pages across virtual machines running on a single host, potentially reducing memory usage and improving system performance.
Rationale
Sharing resources introduces the risk of memory corruption attacks, unauthorized or unintended sharing of information, and the manipulation of data flow restrictions.
Impact
Disabling Kernel Samepage Merging (KSM) does not impact normal node operations. Workloads requiring a high amount of memory usage could potentially see an impact on system performance.
Audit Procedure
Use the following command to list KSM configuration for hyperconverged resources:
$ oc get hyperconvergeds kubevirt-hyperconverged -n openshift-cnv -ojsonpath='{.spec.ksmConfiguration}'
Remediation
Disable the KSM feature. For example, by directly editing the object with oc edit hyperconverged kubevirt-hyperconverged -n openshift-cnv and set the field to false.
Default Value
KSM is disabled by default. The command should return false.
References
- CIS Redhat OpenShift Virtual Machine Extension Benchmark v1.0.0, Section 1.7
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | N | Y | Y |
| v7 | 9.1 Associate Active Ports, Services and Protocols to Asset Inventory | N | Y | Y |
MITRE ATT&CK Mappings
| Tactic | Technique |
|---|---|
| Credential Access | T1212 Exploitation for Credential Access |
| Collection | T1005 Data from Local System |
Profile
- Level 2 - OpenShift Virtualization