Prevent loading of unused network protocol modules

Description

The Debian kernel ships network protocols as modules that are loaded automatically the first time a program opens a socket of that family: DCCP, SCTP, RDS, TIPC, ATM and CAN. This control makes modprobe refuse to load them (install <module> /bin/false), keeps them out of automatic loading (blacklist <module>), and checks that none of them is loaded.

Modules that are not built for the running kernel (the Debian cloud kernel has no ATM or CAN) are configured anyway, so that a kernel change does not reopen them. Other protocols not used by the system can be added to the list.

Rationale

These protocols are seldom used on servers and desktops, yet their code is reachable from any unprivileged process through automatic module loading. Several of them had local privilege escalation vulnerabilities (for example in DCCP, RDS and SCTP). Code that cannot be loaded cannot be exploited.

Impact

Applications that need one of these protocols stop working: SCTP for some telecom and clustering software, CAN for automotive and industrial buses, RDS for some database clusters. Remove the module from the net_modules parameter on such systems.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

For each module in {{ net_modules }}:

1. modprobe --showconfig | grep -E '^(install|blacklist) <module>( |$)' shows install <module> /bin/false (or /bin/true) and blacklist <module>;
2. lsmod | grep '^<module> ' prints nothing. Also review lsmod for other network protocol modules the system does not need.

Automated: every check must pass. Scanners report each check by its id.

modules

modprobe configuration and loaded modules for each listed protocol.

script: |
  cfg=$(modprobe --showconfig 2>/dev/null) || exit 3
  rc=0
  for m in $CB_NET_MODULES; do
    bad=
    printf '%s\n' "$cfg" | grep -Eq "^install $m /(usr/)?bin/(false|true)( |$)" || bad="$bad no-install-rule"
    printf '%s\n' "$cfg" | grep -qx "blacklist $m" || bad="$bad not-blacklisted"
    grep -q "^$m " /proc/modules && bad="$bad loaded"
    if [ -n "$bad" ]; then echo "$m:$bad"; rc=1; else echo "$m: disabled"; fi
  done
  exit "$rc"

Remediation

Create /etc/modprobe.d/60-cirsec-net.conf with two lines per module:

install dccp /bin/false
blacklist dccp

then unload any loaded one with modprobe -r <module> (or reboot).

Rollback

Delete /etc/modprobe.d/60-cirsec-net.conf. The modules load on demand again.

modprobe-conf

# CB-DEB-NET-002: keep unused network protocol modules from loading, unload the loaded ones.
f=/etc/modprobe.d/60-cirsec-net.conf
cb_backup "$f"
{
  echo '# Written by CIRSEC Baselines CB-DEB-NET-002'
  for m in $CB_NET_MODULES; do
    printf 'install %s /bin/false\nblacklist %s\n' "$m" "$m"
  done
} >"$f"
chmod 644 "$f"
for m in $CB_NET_MODULES; do
  if grep -q "^$m " /proc/modules && ! modprobe -r "$m"; then
    echo "$m is in use and could not be unloaded, reboot to finish" >&2
    exit 1
  fi
done
exit 0

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• modprobe.d(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• modprobe(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle