The system must disable Inter-VM transparent page sharing.

From VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Part of SRG-OS-000480-VMM-002000

Associated with: CCI-000366

SV-77769r1_rule The system must disable Inter-VM transparent page sharing.

Vulnerability discussion

Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try and determine an AES encryption key in use on another virtual machine running on the same physical processor of the host server if Transparent Page Sharing is enabled between the two virtual machines. This technique works only in a highly controlled system configured in a non-standard way that VMware believes would not be recreated in a production environment.Even though VMware believes information being disclosed in real world conditions is unrealistic, out of an abundance of caution upcoming ESXi Update releases will no longer enable TPS between Virtual Machines by default (TPS will still be utilized within individual VMs).

Check content

From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the Mem.ShareForceSalting value and verify it is set to 2. or From a PowerCLI command prompt while connected to the ESXi host run the following command: Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting If the Mem.ShareForceSalting setting is not set to 2, this is a finding.

Fix text

From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the Mem.ShareForceSalting value and configure it to 2. or From a PowerCLI command prompt while connected to the ESXi host run the following commands: Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting | Set-AdvancedSetting -Value 2

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.