CME-1002
Audit Subsystem (auditd)
Description
Linux kernel audit framework that logs syscalls, file access, authentication events, and security-relevant operations. Provides forensic trail and can trigger alerts.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Compensating control: attacker actions are logged and may trigger alerting |
CWE Relationships
Verification
Verify auditd is running with rules loaded
$ auditctl -s | grep enabled
# Expected: enabled 1
# Expected: enabled 1
Platform: linux
$ auditctl -l | wc -l
# Expected: Non-zero rule count
# Expected: Non-zero rule count
Platform: linux