Detections
Analytics

1.294 OL08-00-040022

Information

OL 8 must not have the Controller Area Network (CAN) kernel module installed if not required for operational support.

GROUP ID: V-248830
RULE ID: SV-248830r991589

The CAN protocol is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other's applications without a host computer. Disabling CAN protects the system against exploitation of any flaws in its implementation.

Solution

Configure OL 8 to disable the ability to use the "can" kernel module.

Create a file under "/etc/modprobe.d" with the following command:

$ sudo touch /etc/modprobe.d/can.conf

Add the following line to the created file:

install can /bin/false

Configure OL 8 to disable the ability to use the can kernel module.

$ sudo vi /etc/modprobe.d/blacklist.conf

Add or update the line:

blacklist can

See Also

https://workbench.cisecurity.org/benchmarks/23791

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-248830r991589_rule, STIG-ID|OL08-00-040022, Vuln-ID|V-248830

Plugin: Unix

Control ID: 22599dc8cd0b9c3aa16612b04a64dfccb4ca896bcb8517572a84768ffad4f84e