VM : TransparentPageSharing-inter-VM-Enabled

Information

Check for enablement of salted VM's that are sharing memory pages.

When salting is enabled (Mem.ShareForceSalting=1 or 2) in order to share a page between two virtual machines both salt and the content of the page must be same. A salt value is a configurable vmx option for each virtual machine. You can manually specify the salt values in the virtual machine's vmx file with the new vmx option sched.mem.pshare.salt. If this option is not present in the virtual machine's vmx file, then the value of vc.uuid vmx option is taken as the default value. Since the vc.uuid is unique to each virtual machine, by default TPS happens only among the pages belonging to a particular virtual machine (Intra-VM).

If a group of virtual machines are considered trustworthy, it is possible to share pages among them by setting a common salt value for all those virtual machines (inter-VM).

Default value is null. When this happens the VM has a random salt value generated.

https://kb.vmware.com/kb/2080735
https://kb.vmware.com/kb/2097593
https://kb.vmware.com/kb/2091682


NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

# Add the setting to all VMs -
$ vmsaltvalue = "<some unique value>"
Get-VM | New-AdvancedSetting -Name "sched.mem.pshare.salt" -value $vmsaltvalue

See Also

https://www.vmware.com/content/dam/digitalmarketing/vmware/en/files/xls/vmware-6-5-update-1-security-configuration-guide.xlsx

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16

Plugin: VMware

Control ID: c23609f21abab7514edceebc5f1927ac66bc91b3ba0dfa01eadf5e1a9be7dcea