VMware ESXi
TMA-ESXI9-2.9
Host must not suppress warnings about unmitigated hyperthreading vulnerabilities
MediumLevel 1Automatedvmware
Description
It is imperative to retain hyperthreading security warnings as they indicate unmitigated CPU vulnerabilities. The parameter governing this behavior is UserVars.SuppressHyperthreadWarning, with a recommended setting of 0. The audit reads UserVars.SuppressHyperthreadWarning with esxcli and requires 0. Runs in the ESXi Shell (busybox sh) as root.
How it is checked
Audit method: Shell command
shell
out=$(esxcli system settings advanced list -o /UserVars/SuppressHyperthreadWarning 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/SuppressHyperthreadWarning: no integer value'; exit 1 ;; esac
if [ "$v" -eq 0 ]; then echo compliant; else echo "/UserVars/SuppressHyperthreadWarning = $v (expected 0)"; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
1. Utilize the administrative PowerCLI session: execute Get-VMHost | Get-AdvancedSetting -Name UserVars.SuppressHyperthreadWarning | Set-AdvancedSetting - Value 0 -Confirm:$false
Properties
- Operating systems
- Any
- Tags
- vmwareesxibase
- Reference
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 2.9 Host must not suppress warnings about unmitigated hyperthreading vulnerabilities
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target vmware