6.7

PCI and PCIe Devices and ESXi
Using the VMware DirectPath I/O feature to pass through a PCI or PCIe device to a virtual machine
results in a potential security vulnerability. The vulnerability can be triggered when buggy or malicious
code, such as a device driver, is running in privileged mode in the guest OS. Industry-standard hardware
and firmware do not currently have sufficient error containment support to protect ESXi hosts from the
vulnerability.
Use PCI or PCIe passthrough to a virtual machine only if a trusted entity owns and administers the virtual
machine. You must be sure that this entity does not to attempt to crash or exploit the host from the virtual
machine.
Your host might be compromised in one of the following ways.
n
The guest OS might generate an unrecoverable PCI or PCIe error. Such an error does not corrupt
data, but can crash the ESXi host. Such errors might occur because of bugs or incompatibilities in the
hardware devices that are being passed through. Other reasons for errors include problems with
drivers in the guest OS.
n
The guest OS might generate a Direct Memory Access (DMA) operation that causes an IOMMU page
fault on the ESXi host. This operation might be the result of a DMA operation that targets an address
outside the virtual machine memory. On some machines, host firmware configures IOMMU faults to
report a fatal error through a non-maskable interrupt (NMI). This fatal error causes the ESXi host to
crash. This problem might occur because of problems with the drivers in the guest OS.
n
If the operating system on the ESXi host is not using interrupt remapping, the guest OS might inject a
spurious interrupt into the ESXi host on any vector. ESXi currently uses interrupt remapping on Intel
platforms where it is available. Interrupt mapping is part of the Intel VT-d feature set. ESXi does not
use interrupt mapping on AMD platforms. A false interrupt can result in a crash of the ESXi host.
Other ways to exploit these false interrupts might exist in theory.
Disable the Managed Object Browser
The managed object browser (MOB) provides a way to explore the VMkernel object model. However,
attackers can use this interface to perform malicious configuration changes or actions because it is
possible to change the host configuration by using the MOB. Use the MOB only for debugging, and
ensure that it is disabled in production systems.
Starting with vSphere 6.0, the MOB is disabled by default. However, for certain tasks, for example when
extracting the old certificate from a system, you have to use the MOB. You can enable and disable the
MOB as follows.
Procedure
1 Select the host in the vSphere Web Client and go to Advanced System Settings.
2 Check the value of Config.HostAgent.plugins.solo.enableMob, and change it as appropriate.
Do not use vim-cmd from the ESXi Shell.
vSphere Security
VMware, Inc. 48