Profile Applicability:
 • Level 1

Description:
 The usb-storage kernel module provides support for USB mass storage devices, allowing the system to access USB-connected storage media.

Rationale:
 Disabling the usb-storage kernel module when not required reduces the attack surface by preventing unauthorized or malicious USB storage devices from being mounted, which helps mitigate data exfiltration and malware introduction risks.

Impact:
 Pros:

  • Prevents unauthorized USB storage device usage.

  • Reduces risk of data theft and malware via USB devices.

Cons:

  • Systems requiring USB storage device access will be unable to mount USB storage devices if the module is disabled.

Default Value:
 The usb-storage module is typically enabled and loaded by default on most Linux systems.

Pre-requisites:

  • Root or sudo privileges to modify kernel module configurations.

  • Access to /etc/modprobe.d/ to configure blacklisting or disabling.

Remediation:

Test Plan:

Using Linux command line:

  1. Check if the usb-storage module is loaded:

     lsmod | grep usb_storage

  2. Verify blacklist or disable entries:

    grep -r usb-storage /etc/modprobe.d/

  3. Test module load behavior:

     modprobe -n -v usb-storage

    Expected output should indicate the module is disabled, e.g., install /bin/false.

Implementation Plan:

Using Linux command line:

  1. Create or edit /etc/modprobe.d/usb-storage.conf:

     echo "install usb-storage /bin/false" > /etc/modprobe.d/usb-storage.conf
 echo "blacklist usb-storage" >> /etc/modprobe.d/usb-storage.conf

  2. Unload the module if currently loaded:

     modprobe -r usb-storage

  3. Reboot the system or reload module configurations.

Backout Plan:

Using Linux command line:

  1. Remove blacklist and disable entries:

    sed -i '/usb-storage/d' /etc/modprobe.d/usb-storage.conf

  2. Optionally reload the module:

    modprobe usb-storage

  3. Reboot the system.

References: