Detections
Analytics

3.2.1 Ensure dccp kernel module is not available

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

-IF- the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.

Solution

Run the following script to disable the dccp module:

-IF- the module is available in the running kernel:

 - Create a file with install dccp /bin/false in the /etc/modprobe.d/ directory
 - Create a file with blacklist dccp in the /etc/modprobe.d/ directory
 - Unload dccp from the kernel

-IF- available in ANY installed kernel:

 - Create a file with blacklist dccp in the /etc/modprobe.d/ directory

-IF- the kernel module is not available on the system or pre-compiled into the kernel:

 - No remediation is necessary

#!/usr/bin/env bash

{
 l_mname="dccp" # set module name
 l_mtype="net" # set module type
 l_mpath="/lib/modules/**/kernel/$l_mtype"
 l_mpname="$(tr '-' '_' <<< "$l_mname")"
 l_mndir="$(tr '-' '/' <<< "$l_mname")"

 module_loadable_fix()
 {
 # If the module is currently loadable, add "install {MODULE_NAME} /bin/false" to a file in "/etc/modprobe.d"
 l_loadable="$(modprobe -n -v "$l_mname")"
 [ "$(wc -l <<< "$l_loadable")" -gt "1" ] && l_loadable="$(grep -P -- "(^\h*install|\b$l_mname)\b" <<< "$l_loadable")"
 if ! grep -Pq -- '^\h*install \/bin\/(true|false)' <<< "$l_loadable"; then
 echo -e "\n - setting module: \"$l_mname\" to be not loadable"
 echo -e "install $l_mname /bin/false" >> /etc/modprobe.d/"$l_mpname".conf
 fi
 }
 module_loaded_fix()
 {
 # If the module is currently loaded, unload the module
 if lsmod | grep "$l_mname" > /dev/null 2>&1; then
 echo -e "\n - unloading module \"$l_mname\""
 modprobe -r "$l_mname"
 fi
 }
 module_deny_fix()
 {
 # If the module isn't deny listed, denylist the module
 if ! modprobe --showconfig | grep -Pq -- "^\h*blacklist\h+$l_mpname\b"; then
 echo -e "\n - deny listing \"$l_mname\""
 echo -e "blacklist $l_mname" >> /etc/modprobe.d/"$l_mpname".conf
 fi
 }
 # Check if the module exists on the system
 for l_mdir in $l_mpath; do
 if [ -d "$l_mdir/$l_mndir" ] && [ -n "$(ls -A $l_mdir/$l_mndir)" ]; then
 echo -e "\n - module: \"$l_mname\" exists in \"$l_mdir\"\n - checking if disabled..."
 module_deny_fix
 if [ "$l_mdir" = "/lib/modules/$(uname -r)/kernel/$l_mtype" ]; then
 module_loadable_fix
 module_loaded_fix
 fi
 else
 echo -e "\n - module: \"$l_mname\" doesn't exist in \"$l_mdir\"\n"
 fi
 done
 echo -e "\n - remediation of module: \"$l_mname\" complete\n"
}

See Also

https://workbench.cisecurity.org/benchmarks/15288

Item Details

References: CSCv7|9.2

Plugin: Unix

Control ID: 0a596915b09d5a9a27f27fa70dcf9fb76a2fbd125edb67dd6088d7b056fed2c1