STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must restrict access to the kernel message buffer.

DISA Rule

SV-260472r1137695_rule

Vulnerability Number

V-260472

Group Title

SRG-OS-000138-GPOS-00069

Rule Version

UBTU-22-213010

Severity

CAT III

CCI(s)

• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.

Weight

10

Fix Recommendation

Configure Ubuntu 22.04 LTS to restrict access to the kernel message buffer.

Add or modify the following line in the "/etc/sysctl.conf" file:

kernel.dmesg_restrict = 1

Remove any configurations that conflict with the above from the following locations:

/run/sysctl.d/
/etc/sysctl.d/
/usr/local/lib/sysctl.d/
/usr/lib/sysctl.d/
/lib/sysctl.d/
/etc/sysctl.conf

Reload settings from all system configuration files by using the following command:

$ sudo sysctl --system

Check Contents

Verify Ubuntu 22.04 LTS is configured to restrict access to the kernel message buffer by using the following command:

$ sysctl kernel.dmesg_restrict
kernel.dmesg_restrict = 1

If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.

Verify that there are no configurations that enable the kernel dmesg function:

$ sudo grep -ir kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
/etc/sysctl.d/10-kernel-hardening.conf:kernel.dmesg_restrict = 1

If "kernel.dmesg_restrict" is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.

Vulnerability Number

V-260472

Documentable

False

Rule Version

UBTU-22-213010

Severity Override Guidance

Verify Ubuntu 22.04 LTS is configured to restrict access to the kernel message buffer by using the following command:

$ sysctl kernel.dmesg_restrict
kernel.dmesg_restrict = 1

If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.

Verify that there are no configurations that enable the kernel dmesg function:

$ sudo grep -ir kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
/etc/sysctl.d/10-kernel-hardening.conf:kernel.dmesg_restrict = 1

If "kernel.dmesg_restrict" is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.

Check Content Reference

M

Target Key

5594