Host hardware must have auditable, authentic, and up to date system & device firmware

MoyenneNiveau 1Revue manuellevmware

Description

Hardware firmware is not immune to serious issues affecting confidentiality, integrity, or availability. Vulnerable system management controllers & management engines can provide places for attackers to establish persistence, in order to re-infect and re- compromise hosts after reboots and updates. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

The preferred approach is to utilize a vendor-supported, VMware-compatible firmware and driver combination. Leverage Broadcom's Lifecycle Manager hardware compatibility checks or similar tools if available. If that is not available, manually inventory: System BIOS/UEFI BMC / iDRAC / iLO firmware TPM firmware RAID/storage controller firmware HBA firmware NIC firmware Fibre Channel adapter firmware NVMe / storage-device firmware where applicable GPU firmware where applicable compare those results with the currently supported and recommended baseline as well as VMware Compatibility Guide for ...

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Proposed remediation guidelines: 1. Verify the exact server model and hardware components. 2. Obtain firmware only from the OEM/vendor: Dell HPE Lenovo Cisco etc. 3. Verify that the proposed firmware and associated ESXi driver are supported for your ESXi 8 release. 4. Place the ESXi host in maintenance mode. 5. Apply firmware through the vendor-supported mechanism (for example): Dell iDRAC / OpenManage HPE iLO / SPP Lenovo XClarity Cisco UCS Manager Vendor bootable firmware package Vendor Hardware Support Manager 6. Reboot the physical host if required. 7. Re-run the firmware inventory. 8. Confirm device/driver/firmware compatibility. 9. Exit maintenance mode.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: vmwareesxihardware
Référence: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 1.1 Host hardware must have auditable, authentic, and up to date system & device firmware