Vulnerability Response

Vulnerability Response

Tracking and mitigating known kernel vulnerabilities across the fleet.

Architecture

Kernel module blocking lives in modules/security.nix under the permanent hardening.kernel block (enabled by default on all hosts). Two layers:

LayerMechanismScope
boot.blacklistedKernelModulesKernel cmdline modprobe.blacklist=Prevents auto-load on hardware probe
boot.extraModprobeConfiginstall <mod> /bin/falseBlocks ALL loads including explicit modprobe

Both are needed: blacklistedKernelModules is advisory (some kernel paths bypass it), while install ... /bin/false makes modprobe itself refuse.

Blocked Modules

ModuleReason
dccp, sctp, rds, tipcRare/unused transport protocols
algif_aead, algif_skcipherAF_ALG AEAD — kernel crypto surface
xfrm_algo, xfrm_user, xfrm4_tunnel, xfrm6_tunnelIPsec XFRM framework
esp4, esp6, esp4_offload, esp6_offloadESP packet transformation
rxrpcAF_RXRPC — rarely used

Adding a Temporary CVE Mitigation

When a new vulnerability appears that needs fleet-wide mitigation before upstream patches land:

  1. Add modules to the blacklist and extraModprobeConfig in modules/security.nix under the hardening.kernel block.

  2. Gate with a new option if the mitigation is destructive or should be toggleable per-host:

    options.modules.security.hardening = {
  # ... existing options ...
  blockNewVuln = mkBoolOpt true;
};

  3. Document the CVE/exploit here with references.

  4. Deploy to all affected hosts.

  5. Remove when patched — once all hosts run a fixed kernel, delete the module entries and any temporary option.

Historical Mitigations

Dirty Frag (xfrm-ESP + RxRPC Page-Cache Write LPE) — mitigated 2026-04

FieldDetail
ClassLocal privilege escalation via page-cache write
Vectorsxfrm-ESP (since Linux 4.10), RxRPC (since Linux 6.4)
ImpactUnprivileged user → root
Affected kernels4.10 through current (xfrm-ESP), 6.4+ (RxRPC)
Fix commitf4c50a4034e6 (“xfrm: fix page-cache write in xfrm-esp”)
ResearcherHyunwoo Kim (@v4bel)
Referenceshttps://github.com/V4bel/dirtyfrag, https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel

Originally tracked under modules.security.vulnerabilities.dirtyFrag (removed 2026-05). Now part of the permanent hardening block as general AEAD/ESP/XFRM attack surface reduction.

Verification

# Blacklist took effect (check kernel cmdline):
cat /proc/cmdline | tr ' ' '\n' | grep modprobe

# Modules not loaded:
lsmod | grep -E 'algif|xfrm|esp|rxrpc'

# modprobe blocked (should return non-zero):
modprobe esp4; echo $?   # → 1

hey check Integration

boot.blacklistedKernelModules generates modprobe.blacklist=... on the kernel command line. hey check flake validates the config but not runtime state — verify on the target host after deploy.