STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

TOSS must disable access to network bpf syscall from unprivileged processes.

DISA Rule

SV-253113r991589_rule

Vulnerability Number

V-253113

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

TOSS-04-040720

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure TOSS to prevent privilege escalation thru the kernel by disabling access to the bpf syscall by adding the following line to a file in the "/etc/sysctl.d" directory:

kernel.unprivileged_bpf_disabled = 1

The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command:

$ sudo sysctl --system

Check Contents

Verify TOSS prevents privilege escalation thru the kernel by disabling access to the bpf syscall with the following commands:

$ sudo sysctl kernel.unprivileged_bpf_disabled

kernel.unprivileged_bpf_disabled = 1

If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Vulnerability Number

V-253113

Documentable

False

Rule Version

TOSS-04-040720

Severity Override Guidance

Verify TOSS prevents privilege escalation thru the kernel by disabling access to the bpf syscall with the following commands:

$ sudo sysctl kernel.unprivileged_bpf_disabled

kernel.unprivileged_bpf_disabled = 1

If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Check Content Reference

M

Target Key

5469