cis-ubuntu2004-v300-1-1-1-10

name	cis-ubuntu2004-v300-1-1-1-10
description	Ensure unused filesystems kernel modules are not available
category	cis-storage
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","kernel-module"]
cis_id	1.1.1.10
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure unused filesystems kernel modules are not available

Profile

Level 1 - Server, Level 1 - Workstation, Assessment: Manual

Description

Filesystem kernel modules are pieces of code that can be dynamically loaded into the Linux kernel to extend its filesystem capabilities, or so-called base kernel, of an operating system. Filesystem kernel modules are typically used to add support for new hardware (as device drivers), or for adding system calls.

Rationale

While loadable filesystem kernel modules are a convenient method of modifying the running kernel, this can be abused by attackers on a compromised system to prevent detection of their processes or files, allowing them to maintain control over the system. Many rootkits make use of loadable filesystem kernel modules in this way.

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it. The following filesystem kernel modules have known CVE's and should be made unavailable if no dependencies exist:

• afs - CVE-2022-37402
• ceph - CVE-2022-0670
• cifs - CVE-2022-29869
• exfat CVE-2022-29973
• ext CVE-2022-1184
• fat CVE-2022-22043
• fscache CVE-2022-3630
• fuse CVE-2023-0386
• gfs2 CVE-2023-3212
• nfs_common CVE-2023-6660
• nfsd CVE-2022-43945
• smbfs_common CVE-2022-2585

Impact

This list may be quite extensive and covering all edges cases is difficult. Therefore, it's crucial to carefully consider the implications and dependencies before making any changes to the filesystem kernel module configurations.

WARNING: disabling or denylisting filesystem modules that are in use on the system may be FATAL. It is extremely important to thoroughly review this list.

Audit Procedure

Command Line

Run the following script to:

• Look at the filesystem kernel modules available to the currently running kernel.
• Exclude mounted filesystem kernel modules that don't currently have a CVE
• List filesystem kernel modules that are not fully disabled, or are loaded into the kernel

Review the generated output.

#!/usr/bin/env bash

{
   a_output=(); a_output2=(); a_modprobe_config=(); a_excluded=(); a_available_modules=()
   a_ignore=(    )
   a_cve_exists=(           )
   ()
   {
      l_out2=; grep -Pq --  <<<  && l_out2=
       ! grep -Pq --  <<< ; 
         a_output2+=()
       ! grep -Pq --  <<< ; 
         a_output2+=()
      
       lsmod | grep  &> /dev/null; 
         l_output2+=( )
      
   }
    IFS=  -r -d $ l_module_dir; 
      a_available_modules+=()
    < <(find  -mindepth 1 -maxdepth 1 - d ! -empty -print0)
    IFS=  -r l_exclude; 
       grep -Pq --  <<< ; 
         a_output2+=()
      
         grep -Pq --  <<< ; 
         a_output+=()
      
    < <(findmnt -knD | awk  |  -u)
   a_modprobe_config+=()
    < <(modprobe --showconfig | grep -P )
    l_mod_name  ; 
       [  =~ overlay ]] && l_mod_name=
         [  !=  ] && f_module_fix
      
   
   [  -gt 0 ] &&     \
       \
      
    [  -le 0 ]; 
           
   
           
      [  -gt 0 ] &&      
   
}