STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS must restrict access to the kernel message buffer.

DISA Rule

SV-270749r1137695_rule

Vulnerability Number

V-270749

Group Title

SRG-OS-000138-GPOS-00069

Rule Version

UBTU-24-600140

Severity

CAT III

CCI(s)

• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.

Weight

10

Fix Recommendation

Configure Ubuntu 24.04 LTS to restrict access to the kernel message buffer.

Set the system to the required kernel parameter by adding or modifying the following line in /etc/sysctl.conf or a config file in the /etc/sysctl.d/ directory:

kernel.dmesg_restrict = 1

Remove any configurations that conflict with the above from the following locations:
/run/sysctl.d/
/etc/sysctl.d/
/usr/local/lib/sysctl.d/
/usr/lib/sysctl.d/
/lib/sysctl.d/
/etc/sysctl.conf

Reload settings from all system configuration files with the following command:

$ sudo sysctl --system

Check Contents

Verify Ubuntu 24.04 LTS is configured to restrict access to the kernel message buffer with the following command:

$ sysctl kernel.dmesg_restrict
kernel.dmesg_restrict = 1

If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.

Verify there are no configurations that enable the kernel dmesg function:

$ sudo grep -r kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
/etc/sysctl.d/10-kernel-hardening.conf:kernel.dmesg_restrict = 1

If any instance of "kernel.dmesg_restrict" is uncommented and set to "0", or if conflicting results are returned, this is a finding.

Vulnerability Number

V-270749

Documentable

False

Rule Version

UBTU-24-600140

Severity Override Guidance

Verify Ubuntu 24.04 LTS is configured to restrict access to the kernel message buffer with the following command:

$ sysctl kernel.dmesg_restrict
kernel.dmesg_restrict = 1

If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.

Verify there are no configurations that enable the kernel dmesg function:

$ sudo grep -r kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
/etc/sysctl.d/10-kernel-hardening.conf:kernel.dmesg_restrict = 1

If any instance of "kernel.dmesg_restrict" is uncommented and set to "0", or if conflicting results are returned, this is a finding.

Check Content Reference

M

Target Key

5673