cis-ubuntu1804-v220-3-2-4

name	cis-ubuntu1804-v220-3-2-4
description	Ensure sctp kernel module is not available
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","networking","kernel-module"]
cis_id	3.2.4
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 3.2.4

Description

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale

If the protocol is not being used, it is recommended that the kernel module drivers not be installed to reduce the potential attack surface.

Impact

None.

Audit Procedure

Command Line

Run the following script to verify the sctp module is not available:

#!/usr/bin/bash
{
  l_mname="sctp"
  l_mtype="net"
  l_output="" l_output2=""

  l_loadable="$(modprobe -n -v "$l_mname")"
  [ "$(wc -l <<< "$l_loadable")" -gt "1" ] && l_loadable="$(grep -P -- "(^\h*install|\b$l_mname)\b" <<< "$l_loadable")"
  if grep -Pq -- '^\h*install \/bin\/(true|false)' <<< "$l_loadable"; then
    l_output="$l_output\n - module: \"$l_mname\" is not loadable: \"$l_loadable\""
  else
    l_output2="$l_output2\n - module: \"$l_mname\" is loadable: \"$l_loadable\""
  fi

  if ! lsmod | grep "" > /dev/null 2>&1; 
    l_output=
  
    l_output2=
  

   modprobe --showconfig | grep -Pq -- ; 
    l_output=
  
    l_output2=
  

   [ -z  ]; 
     -e 
  
     -e 
    [ -n  ] &&  -e 
  
}