8.5.2 Ensure hardware-based 3D acceleration is disabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Due to performance reasons, modern graphic rendering is done within a dedicated graphic processing unit (GPU). Virtual machines can use the host-based GPU for such operations as well. Such dedicated hardware is typically accessed by using complex APIs like OpenGL and DirectX. This hardware-based 3D acceleration should be disabled if it is not needed.

Rationale:

Security flaws within APIs can lead to serious security breaches like memory corruption, denial of service, and remote code execution.

Solution

To disable hardware-based 3D acceleration, run the following PowerCLI command:

# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'mks.enable3d' -value $false

See Also

https://workbench.cisecurity.org/files/3511