cis-ubuntu2004-v300-1-1-1-6

name	cis-ubuntu2004-v300-1-1-1-6
description	Ensure overlay kernel module is not available
category	cis-storage
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","kernel-module"]
cis_id	1.1.1.6
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure overlay kernel module is not available

Profile

Level 2 - Server, Level 2 - Workstation, Assessment: Automated

Description

overlay is a Linux filesystem that layers multiple filesystems to create a single unified view which allows a user to "merge" several mount points into a unified filesystem.

Rationale

The overlay has known CVE's: CVE-2023-32629, CVE-2023-2640, CVE-2023-0386. Disabling the overlay reduces the local attack surface by removing support for unnecessary filesystem types and mitigates potential risks associated with unauthorized execution of setuid files, enhancing the overall system security.

Impact

WARNING: If Container applications such as Docker, Kubernetes, Podman, Linux Containers (LXC), etc. are in use proceed with caution and consider the impact on containerized workloads, as disabling the overlay may severely disrupt containerization.

Audit Procedure

Command Line

Verify the overlay kernel module is not available on the system or has been disabled.

Run the following script to determine if the overlay kernel module is available on the system:

#!/usr/bin/env bash

{
   l_mod_name="overlayfs" l_mod_type="fs"
   while IFS= read -r l_mod_path; do
      if [ -d "$l_mod_path/${l_mod_name}/-/\/" ] &&  [ -n "$(ls -A "$l_mod_path/${l_mod_name}/-/\/")" ]; then
         printf '%s\n' "$l_mod_name exists in $l_mod_path"
      fi
   done < <(readlink -f /usr/lib/modules/**/kernel/$l_mod_type || readlink -f /lib/modules/**/kernel/)
}