CME-109

Kernel Lockdown Mode

Harden OS/Kernel Unquantified evidence Preventive

Description

LSM that restricts kernel features allowing arbitrary code execution or direct hardware access from userspace. Integrity mode blocks module parameters, ACPI tables, and iopl/ioperm. Confidentiality mode additionally blocks /dev/mem, kprobes, and BPF reads.

CVSS Vector Impacts

Metric	Transition	Rationale
Privileges Required (PR)	L → H	Even root cannot modify running kernel via blocked interfaces
Attack Complexity (AC)	L → H	Many kernel exploitation primitives are disabled

CWE Relationships

CWE-269 CWE-284

Verification

Check lockdown LSM state

$ cat /sys/kernel/security/lockdown
# Expected: [integrity]

Platform: linux

Remediation

linux Enable kernel lockdown integrity mode via GRUB boot parameter


grubby --update-kernel=ALL --args='lockdown=integrity'
systemctl reboot

linux Enable kernel lockdown confidentiality mode via GRUB boot parameter


grubby --update-kernel=ALL --args='lockdown=confidentiality'
systemctl reboot