Detections
Analytics

7.23 Virtual machines must restrict sharing of memory pages with other VMs

Information

Configuring virtual machines with the sched.mem.pshare.salt option restricts Transparent Page Sharing (TPS) among different VMs, mitigating the risk of unauthorized data access under certain conditions. By doing so, each VM operates with a distinct memory sharing pool, thereby enhancing isolation and security. The parameter governing this behavior is sched.mem.pshare.salt.

Restricting memory page sharing among VMs minimizes the potential for unauthorized data access, thus aligning with best practices of data isolation and security. This configuration is a proactive measure to mitigate vulnerabilities associated with memory sharing.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To remediate this recommendation, remove legacy settings that deliberately use a common salt across VMs. Where an explicit salt is required, configure a unique value per VM and maintain the ESXi default behavior that prevents inter-VM page sharing.

Impact:

There is no functional impact associated with this security control as it serves to bolster the security posture of the VMs without affecting their operational performance or functionality.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: VMware

Control ID: 91e2d9e14fb59a35e3ecfc537127dbb649435de1f36ffb0139bdfb63ee03ca29