1.1.1.4 Ensure mounting of FAT filesystems is limited - EFI

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

Notes:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

Solution

Edit or create a file in the /etc/modprobe.d/ directory ending in .conf and add the following lines:
Example: vim /etc/modprobe.d/fat.conf

install fat /bin/true
install vfat /bin/true
install msdos /bin/true

Run the following commands to unload the msdos, vfat, and fat modules:

# rmmod msdos
# rmmod vfat
# rmmod fat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

See Also

https://workbench.cisecurity.org/files/2851

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6

Plugin: Unix

Control ID: f80360b54a02f212a87fb8c139b50e0f69eebd510ddd65795b82f3527c3dfea4