VMware ESXi
TMA-ESXI9-1.1
Host hardware must have auditable, authentic, and up to date system & device firmware
설명
Hardware firmware is not immune to serious issues affecting confidentiality, integrity, or availability. Vulnerable system management controllers & management engines can provide places for attackers to establish persistence, in order to re-infect and re- compromise hosts after reboots and updates. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.
점검 방법
감사 방식: 수동 검토
The preferred approach is to utilize a vendor-supported, VMware-compatible firmware and driver combination. Leverage Broadcom's Lifecycle Manager hardware compatibility checks or similar tools if available. If that is not available, manually inventory: System BIOS/UEFI BMC / iDRAC / iLO firmware TPM firmware RAID/storage controller firmware HBA firmware NIC firmware Fibre Channel adapter firmware NVMe / storage-device firmware where applicable GPU firmware where applicable compare those results with the currently supported and recommended baseline as well as VMware Compatibility Guide for ...
조치 방법
조치 방식: 가이드 또는 인프라 패치
Proposed remediation guidelines: 1. Verify the exact server model and hardware components. 2. Obtain firmware only from the OEM/vendor: Dell HPE Lenovo Cisco etc. 3. Verify that the proposed firmware and associated ESXi driver are supported for your ESXi 8 release. 4. Place the ESXi host in maintenance mode. 5. Apply firmware through the vendor-supported mechanism (for example): Dell iDRAC / OpenManage HPE iLO / SPP Lenovo XClarity Cisco UCS Manager Vendor bootable firmware package Vendor Hardware Support Manager 6. Reboot the physical host if required. 7. Re-run the firmware inventory. 8. Confirm device/driver/firmware compatibility. 9. Exit maintenance mode.
속성
- 운영 체제
- 모두
- 태그
- vmwareesxihardware
- 참고 자료
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 1.1 Host hardware must have auditable, authentic, and up to date system & device firmware