STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

Red Hat Enterprise Linux CoreOS (RHCOS) must disable USB Storage kernel module.

DISA Rule

SV-257584r1208209_rule

Vulnerability Number

V-257584

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-OS-001020

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Apply the machine config to disable USB Storage to load USB Storage kernel module by executing the following:

for mcpool in $(oc get mcp -oname | sed 's:.*/::' ); do
echo 'apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 80-kernmod-usb-storage-disable-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
storage:
files:
- contents:
source: data:,install%20usb-storage%20/bin/true%0A
mode: 0644
path: /etc/modprobe.d/75-kernel_module_usb-storage_disabled.conf
overwrite: true
' | oc apply -f -
done

Where OpenShift Virtualization is enabled:

Remove individual devices (e.g. DEVICE_A at index 0):
$ oc patch hyperconverged kubevirt-hyperconverged -n openshift-cnv
--type='json' -p='[
{"op": "remove", "path":
"/spec/permittedHostDevices/pciHostDevices/0"},

]'

Remove all devices:
$ oc patch hyperconverged kubevirt-hyperconverged -n openshift-cnv
--type='json' -p='[
{"op": "remove", "path": "/spec/permittedHostDevices"},
]'

Check Contents

Verify the operating system disables the ability to load the USB Storage kernel module by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n '$HOSTNAME '; grep -r usb-storage /etc/modprobe.d/* | grep -i '/bin/true'' 2>/dev/null; done

install usb-storage /bin/true

If the command does not return any output, or the line is commented out, and use of USB Storage is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv
-ojsonpath='{.spec.permittedHostDevices}'

If unapproved devices are listed, this is a finding.

Vulnerability Number

V-257584

Documentable

False

Rule Version

CNTR-OS-001020

Severity Override Guidance

Verify the operating system disables the ability to load the USB Storage kernel module by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n '$HOSTNAME '; grep -r usb-storage /etc/modprobe.d/* | grep -i '/bin/true'' 2>/dev/null; done

install usb-storage /bin/true

If the command does not return any output, or the line is commented out, and use of USB Storage is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv
-ojsonpath='{.spec.permittedHostDevices}'

If unapproved devices are listed, this is a finding.

Check Content Reference

M

Target Key

5547