Host must restrict inter-VM transparent page sharing

MittelStufe 1Automatisiertvmware

Beschreibung

Transparent Page Sharing (TPS) aids in optimizing memory usage among virtual machines but under certain circumstances can be exploited to access data on adjacent virtual machines unauthorizedly. By configuring the Mem.ShareForceSalting parameter, inter-VM TPS is restricted, enhancing isolation and security. The audit reads Mem.ShareForceSalting with esxcli and requires 2. Runs in the ESXi Shell (busybox sh) as root.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

out=$(esxcli system settings advanced list -o /Mem/ShareForceSalting 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Mem/ShareForceSalting: no integer value'; exit 1 ;; esac
if [ "$v" -eq 2 ]; then echo compliant; else echo "/Mem/ShareForceSalting = $v (expected 2)"; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

From the vSphere Web Client: 1. Select a host 2. Click Configure then expand System then select Advanced System settings. 3. Click Edit then Filter for Mem.ShareForceSalting. 4. Set the value to 2. 5. Click OK. Additionally, the following PowerCLI command can be used: Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting | Set-AdvancedSetting -Value 2

Eigenschaften

Betriebssysteme: Beliebig
Tags: vmwareesxibase
Referenz: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 2.10 Host must restrict inter-VM transparent page sharing

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target vmware