STIGQter: STIG Summary: VMware vSphere 7.0 Virtual Machine Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 30 Jan 2025:

DirectPath I/O must be disabled on the virtual machine (VM) when not required.

DISA Rule

SV-256476r959010_rule

Vulnerability Number

V-256476

Group Title

SRG-OS-000480-VMM-002000

Rule Version

VMCH-70-000028

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

From the vSphere Client, select the Virtual Machine, right-click, and go to Edit Settings >> Virtual Hardware tab.

Find the unexpected PCI device returned from the check.

Hover the mouse over the device and click the circled "X" to remove the device. Click "OK".

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-AdvancedSetting -Name pciPassthruX.present | Remove-AdvancedSetting

Note: Change the "X" value to match the specific setting in the organization's environment.

Check Contents

From the vSphere Client, select the Virtual Machine, right-click, and go to Edit Settings >> VM Options tab >> Advanced >> Configuration Parameters >> Edit Configuration.

Find any "pciPassthruX.present" value (where "X" is a count starting at 0) and verify it is set to "FALSE" or "".

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-AdvancedSetting -Name "pciPassthru*.present" | Select Entity, Name, Value

If the virtual machine advanced setting "pciPassthruX.present" is present, and the specific device returned is not approved, this is a finding.

If the virtual machine advanced setting "pciPassthruX.present" is not present, this is not a finding.

Vulnerability Number

V-256476

Documentable

False

Rule Version

VMCH-70-000028

Severity Override Guidance

Check Content Reference

Target Key

5519