CME-110
KEXEC Restriction
Description
Prevents loading a new kernel at runtime via kexec, blocking a vector for kernel-level persistence and Secure Boot bypass.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Cannot replace running kernel to bypass security controls |
CWE Relationships
Verification
Check kexec_load_disabled sysctl
$ cat /proc/sys/kernel/kexec_load_disabled
# Expected: 1
# Expected: 1
Platform: linux
Remediation
linux
Disable kexec_load via sysctl (one-way latch)
sysctl -w kernel.kexec_load_disabled=1
printf 'kernel.kexec_load_disabled = 1
' > /etc/sysctl.d/99-cme-110-kexec.conf