STIGQter: STIG Summary: VMware vSphere 8.0 Virtual Machine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 01 Aug 2024:

Virtual machines (VMs) must disable DirectPath I/O devices when not required.

DISA Rule

SV-258727r959010_rule

Vulnerability Number

V-258727

Group Title

SRG-OS-000480-VMM-002000

Rule Version

VMCH-80-000214

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

From the vSphere Client, select the Virtual Machine, right-click and go to Edit Settings >> Virtual Hardware tab.

Find the unexpected PCI device returned from the check.

Hover the mouse over the device and click the circled "X" to remove the device. Click "OK".

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-PassthroughDevice | Remove-PassthroughDevice

Check Contents

For each virtual machine do the following:

From the vSphere Client, view the Summary tab.

Review the PCI devices section and verify none exist.

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-PassthroughDevice

If the virtual machine has passthrough devices present, and the specific device returned is not approved, this is a finding.

Vulnerability Number

V-258727

Documentable

False

Rule Version

VMCH-80-000214

Severity Override Guidance

For each virtual machine do the following:

From the vSphere Client, view the Summary tab.

Review the PCI devices section and verify none exist.

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-PassthroughDevice

If the virtual machine has passthrough devices present, and the specific device returned is not approved, this is a finding.

Check Content Reference

M

Target Key

5563