Vulnerability Discussion
USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.
Check
Determine if USB mass storage is disabled with the following command:
$ sudo grep usb-storage /etc/modprobe.d/* | grep -i "blacklist" | grep -v "^#"
/etc/modprobe.d/blacklist.conf:blacklist usb-storage
If the command does not return any output or the output is not "blacklist usb-storage", and use of USB storage devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.
Fix
Configure OL 8 to disable the ability to use USB mass storage devices.
$ sudo vi /etc/modprobe.d/blacklist.conf
Add or update the line:
blacklist usb-storage