STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix AHV must disable the use or cramfs kernel module.

DISA Rule

SV-279572r1192092_rule

Vulnerability Number

V-279572

Group Title

SRG-OS-000095-GPOS-00049

Rule Version

NXAC-OS-000103

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Configure the AOS to disable the ability to use the cramfs kernel module.

1. Add or update the following lines in the file "/etc/modprobe.d/blacklist.conf":

install cramfs /bin/false
blacklist cramfs

2. Reboot the system for the settings to take effect.

Check Contents

For AOS, Prism Central, or Files, this is not a finding.

1. Verify Nutanix AHV disables the ability to load the cramfs kernel module using the following command.

$ sudo grep -r cramfs /etc/modprobe.d/* | grep "/bin/false"
install cramfs /bin/false

If the command does not return any output, or the line is commented out, and using the cramfs protocol is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

2. Verify the operating system disables the ability to use the cramfs kernel module. Check if the cramfs kernel module is disabled using the following command.

$ sudo grep -r cramfs /etc/modprobe.d/* | grep "blacklist"
blacklist cramfs

If the command does not return any output or the output is not "blacklist cramfs", and using the cramfs kernel module is not documented with the ISSO as an operational requirement, this is a finding.

Vulnerability Number

V-279572

Documentable

False

Rule Version

NXAC-OS-000103

Severity Override Guidance

For AOS, Prism Central, or Files, this is not a finding.

1. Verify Nutanix AHV disables the ability to load the cramfs kernel module using the following command.

$ sudo grep -r cramfs /etc/modprobe.d/* | grep "/bin/false"
install cramfs /bin/false

If the command does not return any output, or the line is commented out, and using the cramfs protocol is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

2. Verify the operating system disables the ability to use the cramfs kernel module. Check if the cramfs kernel module is disabled using the following command.

$ sudo grep -r cramfs /etc/modprobe.d/* | grep "blacklist"
blacklist cramfs

If the command does not return any output or the output is not "blacklist cramfs", and using the cramfs kernel module is not documented with the ISSO as an operational requirement, this is a finding.

Check Content Reference

M

Target Key

5730