{
  "id": "CB-UBU-NET-002",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-002",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-002.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-002.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-NET-002",
    "title": "Prevent loading of unused network protocol modules",
    "finding": {
      "title": "Rarely used network protocol modules can be loaded on demand",
      "description": "Any user can make the kernel load these modules by opening a socket of their protocol, exposing code with a history of vulnerabilities."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "kernel",
      "modules",
      "network"
    ],
    "description": "The Ubuntu kernel ships network protocols as modules that are loaded automatically the first\ntime a program opens a socket of that family: DCCP, SCTP, RDS, TIPC, ATM and CAN. This control\nmakes `modprobe` refuse to load them (`install <module> /bin/false`), keeps them out of\nautomatic loading (`blacklist <module>`), and checks that none of them is loaded.\n",
    "rationale": "These protocols are seldom used on servers and desktops, yet their code is reachable from any\nunprivileged process through automatic module loading. Several of them had local privilege\nescalation vulnerabilities (for example in DCCP, RDS and SCTP). Code that cannot be loaded\ncannot be exploited.\n",
    "impact": "Applications that need one of these protocols stop working: SCTP for some telecom and\nclustering software, CAN for automotive and industrial buses, RDS for some database clusters.\nRemove the module from the `net_modules` parameter on such systems.\n",
    "notes": "Modules that are not built for the running kernel (RDS is missing from the 20.04 to 24.04\nkernels, DCCP was removed from the 26.04 kernel) are configured anyway, so that a kernel change does not reopen them. Other protocols not used\nby the system can be added to the list.\n",
    "setting": {
      "location": "/etc/modprobe.d/60-cirsec-net.conf",
      "default_value": "Modules loaded on demand",
      "recommended_value": "install /bin/false and blacklist for: {{ net_modules }}"
    },
    "parameters": [
      {
        "name": "net_modules",
        "type": "list",
        "description": "Kernel modules of network protocols that must not be loaded.",
        "default": [
          "dccp",
          "sctp",
          "rds",
          "tipc",
          "atm",
          "can"
        ]
      }
    ],
    "audit": {
      "manual": "For each module in `{{ net_modules }}`:\n1. `modprobe --showconfig | grep -E '^(install|blacklist) <module>( |$)'` shows\n   `install <module> /bin/false` (or `/bin/true`) and `blacklist <module>`;\n2. `lsmod | grep '^<module> '` prints nothing.\nAlso review `lsmod` for other network protocol modules the system does not need.\n",
      "checks": [
        {
          "id": "modules",
          "engine": "shell",
          "description": "modprobe configuration and loaded modules for each listed protocol.",
          "spec": {
            "script": "cfg=$(modprobe --showconfig 2>/dev/null) || exit 3\nrc=0\nfor m in $CB_NET_MODULES; do\n  bad=\n  printf '%s\\n' \"$cfg\" | grep -Eq \"^install $m /(usr/)?bin/(false|true)( |$)\" || bad=\"$bad no-install-rule\"\n  printf '%s\\n' \"$cfg\" | grep -qx \"blacklist $m\" || bad=\"$bad not-blacklisted\"\n  grep -q \"^$m \" /proc/modules && bad=\"$bad loaded\"\n  if [ -n \"$bad\" ]; then echo \"$m:$bad\"; rc=1; else echo \"$m: disabled\"; fi\ndone\nexit \"$rc\"\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Create `/etc/modprobe.d/60-cirsec-net.conf` with two lines per module:\n```\ninstall dccp /bin/false\nblacklist dccp\n```\nthen unload any loaded one with `modprobe -r <module>` (or reboot).\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Delete `/etc/modprobe.d/60-cirsec-net.conf`. The modules load on demand again.\n",
      "scripts": [
        {
          "id": "modprobe-conf",
          "engine": "shell",
          "file": "fix.sh"
        }
      ]
    },
    "references": [
      {
        "title": "modprobe.d(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/modprobe.d.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "modprobe(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/modprobe.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1068"
      },
      {
        "framework": "cwe",
        "id": "CWE-1188"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot",
        "notes": "Fails on a fresh install; fix.sh writes install /bin/false and blacklist for the six modules; passes after remediation and reboot; second remediate leaves it alone."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot",
        "notes": "Fails on a fresh install; fix.sh writes install /bin/false and blacklist for the six modules; passes after remediation and reboot; second remediate leaves it alone."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "Fails on a fresh install; fix.sh writes install /bin/false and blacklist for the six modules; passes after remediation and reboot; second remediate leaves it alone."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "Fails on a fresh install; fix.sh writes install /bin/false and blacklist for the six modules; passes after remediation and reboot; second remediate leaves it alone."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}