Host hardware must have auditable, authentic, and up to date system & device firmware

MediumLevel 1Manual reviewvmware

Description

Hardware firmware is not immune to serious issues affecting confidentiality, integrity, or availability. Vulnerable system management controllers & management engines can provide places for attackers to establish persistence, in order to re-infect and re- compromise hosts after reboots and updates. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

The preferred approach is to utilize a vendor-supported, VMware-compatible firmware and driver combination. Leverage Broadcom's Lifecycle Manager hardware compatibility checks or similar tools if available. If that is not available, manually inventory: System BIOS/UEFI BMC / iDRAC / iLO firmware TPM firmware RAID/storage controller firmware HBA firmware NIC firmware Fibre Channel adapter firmware NVMe / storage-device firmware where applicable GPU firmware where applicable compare those results with the currently supported and recommended baseline as well as VMware Compatibility Guide for ...

How it is fixed

Fix method: Guidance or infrastructure patch

Proposed remediation guidelines: 1. Verify the exact server model and hardware components. 2. Obtain firmware only from the OEM/vendor: Dell HPE Lenovo Cisco etc. 3. Verify that the proposed firmware and associated ESXi driver are supported for your ESXi 8 release. 4. Place the ESXi host in maintenance mode. 5. Apply firmware through the vendor-supported mechanism (for example): Dell iDRAC / OpenManage HPE iLO / SPP Lenovo XClarity Cisco UCS Manager Vendor bootable firmware package Vendor Hardware Support Manager 6. Reboot the physical host if required. 7. Re-run the firmware inventory. 8. Confirm device/driver/firmware compatibility. 9. Exit maintenance mode.

Properties

Operating systems: Any
Tags: vmwareesxihardware
Reference: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 1.1 Host hardware must have auditable, authentic, and up to date system & device firmware