Host must not suppress warnings about unmitigated hyperthreading vulnerabilities

СредњаНиво 1Аутоматскаvmware

Опис

It is imperative to retain hyperthreading security warnings as they indicate unmitigated CPU vulnerabilities. The parameter governing this behavior is UserVars.SuppressHyperthreadWarning, with a recommended setting of 0. The audit reads UserVars.SuppressHyperthreadWarning with esxcli and requires 0. Runs in the ESXi Shell (busybox sh) as root.

Како се проверава

Метод провере: Команда љуске

shell

out=$(esxcli system settings advanced list -o /UserVars/SuppressHyperthreadWarning 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/SuppressHyperthreadWarning: no integer value'; exit 1 ;; esac
if [ "$v" -eq 0 ]; then echo compliant; else echo "/UserVars/SuppressHyperthreadWarning = $v (expected 0)"; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

1. Utilize the administrative PowerCLI session: execute Get-VMHost | Get-AdvancedSetting -Name UserVars.SuppressHyperthreadWarning | Set-AdvancedSetting - Value 0 -Confirm:$false

Својства

Оперативни системи: Било који
Ознаке: vmwareesxibase
Референца: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 2.9 Host must not suppress warnings about unmitigated hyperthreading vulnerabilities

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target vmware