STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

Red Hat Enterprise Linux CoreOS (RHCOS) must implement nonexecutable data to protect its memory from unauthorized code execution.

DISA Rule

SV-257568r961665_rule

Vulnerability Number

V-257568

Group Title

SRG-APP-000450-CTR-001105

Rule Version

CNTR-OS-000860

Severity

CAT II

CCI(s)

• CCI-002824 - Implement organization-defined controls to protect its memory from unauthorized code execution.

Weight

10

Fix Recommendation

The NX bit execute protection must be enabled in the system BIOS. The nodes must be reinstalled. Follow the steps found here for more information:
https://access.redhat.com/solutions/2936741

Check Contents

Verify the NX (no-execution) bit flag is set on the system by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; dmesg | grep Execute ' 2>/dev/null; done

Example Output:([ 0.000000] NX (Execute Disable) protection: active)

If "dmesg" does not show "NX (Execute Disable) protection active", check the cpuinfo settings by executing the following command:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; less /proc/cpuinfo | grep 'nx' /proc/cpuinfo | uniq' 2>/dev/null; done

(Example Output: flags : fpu vme de pse tsc ms nx rdtscp lm constant_tsc...)

If "flags" does not contain the "nx" flag, this is a finding.

Vulnerability Number

V-257568

Documentable

False

Rule Version

CNTR-OS-000860

Severity Override Guidance

Verify the NX (no-execution) bit flag is set on the system by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; dmesg | grep Execute ' 2>/dev/null; done

Example Output:([ 0.000000] NX (Execute Disable) protection: active)

If "dmesg" does not show "NX (Execute Disable) protection active", check the cpuinfo settings by executing the following command:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; less /proc/cpuinfo | grep 'nx' /proc/cpuinfo | uniq' 2>/dev/null; done

(Example Output: flags : fpu vme de pse tsc ms nx rdtscp lm constant_tsc...)

If "flags" does not contain the "nx" flag, this is a finding.

Check Content Reference

M

Target Key

5547