STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must prevent unauthorized and unintended information transfer via shared system resources and enable page poisoning.

DISA Rule

SV-257548r1156737_rule

Vulnerability Number

V-257548

Group Title

SRG-APP-000243-CTR-000600

Rule Version

CNTR-OS-000560

Severity

CAT II

CCI(s)

• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.

Weight

10

Fix Recommendation

Apply the machine config to enable page poisoning by executing the following:

for mcpool in $(oc get mcp -oname | sed 's:.*/::' ); do
echo 'apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 05-kernelarg-page-poison-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
kernelArguments:
- page_poison=1
' | oc apply -f -
done

Where OpenShift Virtualization is enabled and Windows SCF is not in use execute the following:
$ oc patch hyperconverged kubevirt-hyperconverged -n openshift-cnv
--type='json' -p='[
{"op": "replace", "path":
"/spec/featureGates/persistentReservation", "value": false },
]'

Where OpenShift Virtualization is enabled:
Edit the object and set the field to false:
'oc edit hyperconverged kubevirt-hyperconverged -n openshift-cnv'

To set a shareable flag to false on every disk, this (experimental) command can be used:
$ oc get vm <vm-name> -o json | jq
'.spec.template.spec.domain.devices.disks[] += {"shareable":false}' |
oc apply -f -

Check Contents

1. Check the current CoreOS boot loader configuration has page poisoning enabled by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; grep page_poison /boot/loader/entries/*.conf|| echo "not found"' 2>/dev/null; done

If "page_poison" is not set to "1" or returns "not found", this is a finding.

2. Where OpenShift Virtualization is enabled, execute the following:
$ oc get hyperconvergeds kubevirt-hyperconverged -n openshift-cnv
-ojsonpath='{.spec.ksmConfiguration}'

If this is set to anything other than "false", this is a finding.

3. Where OpenShift Virtualization is enabled, execute the following:
$ oc get vm -ojson -A | jq '.items[] |
select(.spec.template.spec.domain.devices.disks[].shareable == true)|
.metadata.namespace + "/" + .metadata.name'

If these results show disks flagged the shareable, this is a finding.

4. Where OpenShift Virtualization is enabled, and Windows SCF is not in use:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv
-ojsonpath='{.spec.featureGates.persistentReservation}'

If this is set to anything other than "false", this is a finding.

Vulnerability Number

V-257548

Documentable

False

Rule Version

CNTR-OS-000560

Severity Override Guidance

1. Check the current CoreOS boot loader configuration has page poisoning enabled by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; grep page_poison /boot/loader/entries/*.conf|| echo "not found"' 2>/dev/null; done

If "page_poison" is not set to "1" or returns "not found", this is a finding.

2. Where OpenShift Virtualization is enabled, execute the following:
$ oc get hyperconvergeds kubevirt-hyperconverged -n openshift-cnv
-ojsonpath='{.spec.ksmConfiguration}'

If this is set to anything other than "false", this is a finding.

3. Where OpenShift Virtualization is enabled, execute the following:
$ oc get vm -ojson -A | jq '.items[] |
select(.spec.template.spec.domain.devices.disks[].shareable == true)|
.metadata.namespace + "/" + .metadata.name'

If these results show disks flagged the shareable, this is a finding.

4. Where OpenShift Virtualization is enabled, and Windows SCF is not in use:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv
-ojsonpath='{.spec.featureGates.persistentReservation}'

If this is set to anything other than "false", this is a finding.

Check Content Reference

M

Target Key

5547