TMA-ESXI9-2.9

Host must not suppress warnings about unmitigated hyperthreading vulnerabilities

MediaNivel 1Automatizadavmware

Descripción

It is imperative to retain hyperthreading security warnings as they indicate unmitigated CPU vulnerabilities. The parameter governing this behavior is UserVars.SuppressHyperthreadWarning, with a recommended setting of 0. The audit reads UserVars.SuppressHyperthreadWarning with esxcli and requires 0. Runs in the ESXi Shell (busybox sh) as root.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(esxcli system settings advanced list -o /UserVars/SuppressHyperthreadWarning 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/SuppressHyperthreadWarning: no integer value'; exit 1 ;; esac
if [ "$v" -eq 0 ]; then echo compliant; else echo "/UserVars/SuppressHyperthreadWarning = $v (expected 0)"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Utilize the administrative PowerCLI session: execute Get-VMHost | Get-AdvancedSetting -Name UserVars.SuppressHyperthreadWarning | Set-AdvancedSetting - Value 0 -Confirm:$false

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: vmwareesxibase
Referencia: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 2.9 Host must not suppress warnings about unmitigated hyperthreading vulnerabilities

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target vmware