Detections
Analytics

7.23 (L1) Virtual machines must restrict sharing of memory pages with other VMs

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Configuring virtual machines with the sched.mem.pshare.salt option restricts Transparent Page Sharing (TPS) among different VMs, mitigating the risk of unauthorized data access under certain conditions. By doing so, each VM operates with a distinct memory sharing pool, thereby enhancing isolation and security. The parameter governing this behavior is sched.mem.pshare.salt.

Restricting memory page sharing among VMs minimizes the potential for unauthorized data access, thus aligning with best practices of data isolation and security. This configuration is a proactive measure to mitigate vulnerabilities associated with memory sharing.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Impact:

There is no functional impact associated with this security control as it serves to bolster the security posture of the VMs without affecting their operational performance or functionality.

See Also

https://workbench.cisecurity.org/benchmarks/21888

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: VMware

Control ID: 91e2d9e14fb59a35e3ecfc537127dbb649435de1f36ffb0139bdfb63ee03ca29