# yaml-language-server: $schema=../../../../schema/control.schema.json id: CB-DEB-NET-002 title: Prevent loading of unused network protocol modules finding: title: Rarely used network protocol modules can be loaded on demand description: Any user can make the kernel load these modules by opening a socket of their protocol, exposing code with a history of vulnerabilities. status: active profiles: [core] risk: severity: medium assessment: automated tags: [kernel, modules, network] description: | The Debian kernel ships network protocols as modules that are loaded automatically the first time a program opens a socket of that family: DCCP, SCTP, RDS, TIPC, ATM and CAN. This control makes `modprobe` refuse to load them (`install /bin/false`), keeps them out of automatic loading (`blacklist `), and checks that none of them is loaded. rationale: | These protocols are seldom used on servers and desktops, yet their code is reachable from any unprivileged process through automatic module loading. Several of them had local privilege escalation vulnerabilities (for example in DCCP, RDS and SCTP). Code that cannot be loaded cannot be exploited. impact: | Applications that need one of these protocols stop working: SCTP for some telecom and clustering software, CAN for automotive and industrial buses, RDS for some database clusters. Remove the module from the `net_modules` parameter on such systems. notes: | Modules that are not built for the running kernel (the Debian cloud kernel has no ATM or CAN) are configured anyway, so that a kernel change does not reopen them. Other protocols not used by the system can be added to the list. setting: location: /etc/modprobe.d/60-cirsec-net.conf default_value: Modules loaded on demand recommended_value: "install /bin/false and blacklist for: {{ net_modules }}" parameters: - name: net_modules type: list description: Kernel modules of network protocols that must not be loaded. default: [dccp, sctp, rds, tipc, atm, can] audit: manual: | For each module in `{{ net_modules }}`: 1. `modprobe --showconfig | grep -E '^(install|blacklist) ( |$)'` shows `install /bin/false` (or `/bin/true`) and `blacklist `; 2. `lsmod | grep '^ '` prints nothing. Also review `lsmod` for other network protocol modules the system does not need. checks: - id: modules engine: shell description: modprobe configuration and loaded modules for each listed protocol. spec: script: | cfg=$(modprobe --showconfig 2>/dev/null) || exit 3 rc=0 for m in $CB_NET_MODULES; do bad= printf '%s\n' "$cfg" | grep -Eq "^install $m /(usr/)?bin/(false|true)( |$)" || bad="$bad no-install-rule" printf '%s\n' "$cfg" | grep -qx "blacklist $m" || bad="$bad not-blacklisted" grep -q "^$m " /proc/modules && bad="$bad loaded" if [ -n "$bad" ]; then echo "$m:$bad"; rc=1; else echo "$m: disabled"; fi done exit "$rc" remediation: manual: | Create `/etc/modprobe.d/60-cirsec-net.conf` with two lines per module: ``` install dccp /bin/false blacklist dccp ``` then unload any loaded one with `modprobe -r ` (or reboot). effects: restart: none disruption: low lockout_risk: false rollback: | Delete `/etc/modprobe.d/60-cirsec-net.conf`. The modules load on demand again. scripts: - id: modprobe-conf engine: shell file: fix.sh references: - title: modprobe.d(5), Debian manual pages url: https://manpages.debian.org/trixie/kmod/modprobe.d.5.en.html publisher: Debian kind: vendor-doc accessed: 2026-10-18 - title: modprobe(8), Debian manual pages url: https://manpages.debian.org/trixie/kmod/modprobe.8.en.html publisher: Debian kind: vendor-doc accessed: 2026-10-18 mappings: - framework: nist-800-53r5 framework_version: "5.1.1" id: CM-7 relation: related - framework: cis-debian-12 framework_version: "2.0.0" id: "3.2.1" relation: equivalent - framework: cis-debian-12 framework_version: "2.0.0" id: "3.2.2" relation: equivalent - framework: cis-debian-12 framework_version: "2.0.0" id: "3.2.3" relation: equivalent - framework: cis-debian-12 framework_version: "2.0.0" id: "3.2.4" relation: equivalent - framework: cis-debian-12 framework_version: "2.0.0" id: "3.2.5" relation: equivalent - framework: cis-debian-12 framework_version: "2.0.0" id: "3.2.6" relation: equivalent - framework: cis-debian-13 framework_version: "1.1.0" id: "3.2.1" relation: equivalent - framework: cis-debian-13 framework_version: "1.1.0" id: "3.2.2" relation: equivalent - framework: cis-debian-13 framework_version: "1.1.0" id: "3.2.3" relation: equivalent - framework: cis-debian-13 framework_version: "1.1.0" id: "3.2.4" relation: equivalent - framework: cis-debian-13 framework_version: "1.1.0" id: "3.2.5" relation: equivalent - framework: cis-debian-13 framework_version: "1.1.0" id: "3.2.6" relation: equivalent - framework: cis-debian-13 framework_version: "1.1.0" id: "3.2.7" relation: partial note: The other unneeded protocols are reviewed by hand (audit.manual) or added to the parameter. threats: - framework: mitre-attack id: T1068 - framework: cwe id: CWE-1188 authors: - name: Alice github: Sn0wAlice verified: - date: 2026-10-18 by: Sn0wAlice versions: ["12"] environment: Proxmox VM 921, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64 notes: "Shell check and fix.sh; modules configured and blacklisted, a loaded sctp module reported and left for reboot; state kept after reboot; fix idempotent." - date: 2026-10-18 by: Sn0wAlice versions: ["13"] environment: Proxmox VM 931, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64 notes: "Shell check and fix.sh; modules configured and blacklisted, a loaded sctp module reported and left for reboot; state kept after reboot; fix idempotent." introduced_in: 0.1.0 created: 2026-10-18 updated: 2026-10-18