Virtual machines (VMs) must disable DirectPath I/O devices when not required.
An XCCDF Rule
Description
<VulnDiscussion>VMDirectPath I/O (PCI passthrough) enables direct assignment of hardware PCI functions to VMs. This gives the VM access to the PCI functions with minimal intervention from the ESXi host. This is a powerful feature for legitimate applications such as virtualized storage appliances, backup appliances, dedicated graphics, etc., but it also allows a potential attacker highly privileged access to underlying hardware and the PCI bus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-258727r959010_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
From the vSphere Client, select the Virtual Machine, right-click and go to Edit Settings >> Virtual Hardware tab.
Find the unexpected PCI device returned from the check.
Hover the mouse over the device and click the circled "X" to remove the device. Click "OK".