Host must not suppress warnings about unmitigated hyperthreading vulnerabilities

MoyenneNiveau 1Automatiséevmware

Description

It is imperative to retain hyperthreading security warnings as they indicate unmitigated CPU vulnerabilities. The parameter governing this behavior is UserVars.SuppressHyperthreadWarning, with a recommended setting of 0. The audit reads UserVars.SuppressHyperthreadWarning with esxcli and requires 0. Runs in the ESXi Shell (busybox sh) as root.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(esxcli system settings advanced list -o /UserVars/SuppressHyperthreadWarning 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/SuppressHyperthreadWarning: no integer value'; exit 1 ;; esac
if [ "$v" -eq 0 ]; then echo compliant; else echo "/UserVars/SuppressHyperthreadWarning = $v (expected 0)"; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

1. Utilize the administrative PowerCLI session: execute Get-VMHost | Get-AdvancedSetting -Name UserVars.SuppressHyperthreadWarning | Set-AdvancedSetting - Value 0 -Confirm:$false

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: vmwareesxibase
Référence: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 2.9 Host must not suppress warnings about unmitigated hyperthreading vulnerabilities

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target vmware