CME-903
Kernel Network Hardening (sysctl)
Description
Kernel network stack hardening via sysctl: enable SYN cookies (TCP SYN flood protection), disable IP forwarding, reject source-routed packets, ignore ICMP redirects, enable reverse path filtering.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Network-level attacks (SYN flood, source routing, ICMP redirect) are blocked |
CWE Relationships
Verification
Check network hardening sysctls
$ sysctl net.ipv4.tcp_syncookies
# Expected: net.ipv4.tcp_syncookies = 1
# Expected: net.ipv4.tcp_syncookies = 1
Platform: linux
$ sysctl net.ipv4.conf.all.accept_redirects
# Expected: net.ipv4.conf.all.accept_redirects = 0
# Expected: net.ipv4.conf.all.accept_redirects = 0
Platform: linux
$ sysctl net.ipv4.conf.all.rp_filter
# Expected: net.ipv4.conf.all.rp_filter = 1
# Expected: net.ipv4.conf.all.rp_filter = 1
Platform: linux