TMA-ESXI9-2.9

Host must not suppress warnings about unmitigated hyperthreading vulnerabilities

MittelStufe 1Automatisiertvmware

Beschreibung

It is imperative to retain hyperthreading security warnings as they indicate unmitigated CPU vulnerabilities. The parameter governing this behavior is UserVars.SuppressHyperthreadWarning, with a recommended setting of 0. The audit reads UserVars.SuppressHyperthreadWarning with esxcli and requires 0. Runs in the ESXi Shell (busybox sh) as root.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

out=$(esxcli system settings advanced list -o /UserVars/SuppressHyperthreadWarning 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/SuppressHyperthreadWarning: no integer value'; exit 1 ;; esac
if [ "$v" -eq 0 ]; then echo compliant; else echo "/UserVars/SuppressHyperthreadWarning = $v (expected 0)"; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

1. Utilize the administrative PowerCLI session: execute Get-VMHost | Get-AdvancedSetting -Name UserVars.SuppressHyperthreadWarning | Set-AdvancedSetting - Value 0 -Confirm:$false

Eigenschaften

Betriebssysteme: Beliebig
Tags: vmwareesxibase
Referenz: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 2.9 Host must not suppress warnings about unmitigated hyperthreading vulnerabilities

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target vmware