Detections
Analytics

2.12 (L2) Host must enable volatile key destruction

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

By default, ESXi ensures that pages allocated for virtual machines (VMs), userspace applications, and kernel threads are zeroed out at the time of allocation, to prevent the exposure of sensitive data like cryptographic keys to other clients. However, these keys can remain in host memory for an extended period if the memory is not reused. The Mem.MemEagerZero parameter can be configured to enforce the zeroing out of userworld and guest memory pages when a userworld process or guest exits, and for kernel threads, memory spaces holding keys are zeroed out as soon as the secret is no longer needed. This practice adheres to the NIAP Virtualization Protection Profile and Server Virtualization Extended Package requirements of zeroing memory that may contain cryptographic keys upon process exit. The parameter governing this behavior is Mem.MemEagerZero with a recommended setting of 1.

Enabling volatile key destruction through the Mem.MemEagerZero parameter enhances the security posture by ensuring that sensitive information such as cryptographic keys are not left residually in the system memory, which could be exploited by malicious entities. This configuration aligns with the guidelines provided by the NIAP Virtualization Protection Profile and Server Virtualization Extended Package, indicating its criticality in maintaining a secure virtualized environment.

Solution

Impact:

Activating volatile key destruction through the Mem.MemEagerZero parameter results in additional shutdown time required for virtual machines, corresponding to the amount of allocated memory. While this may extend the downtime during reboots or migrations, the trade-off ensures a higher level of security by preventing the potential exposure of sensitive data, fulfilling compliance requirements, and aiding in the effective management of cryptographic materials within the virtualized environment.

See Also

https://workbench.cisecurity.org/benchmarks/19200

Item Details

References: CSCv7|5.1

Plugin: VMware

Control ID: add969c634535d83719e4f547028b5f30c77362717ab4dd43aedaada6205ced2