Use of the dvFilter network application programming interfaces (APIs) must be restricted.
An XCCDF Rule
Description
If the organization is not using products that use the dvfilter network API, the host should not be configured to send network information to a virtual machine (VM). If the API is enabled, an attacker might attempt to connect a virtual machine to it, potentially providing access to the network of other VMs on the host. If using a product that makes use of this API, verify the host has been configured correctly. If not using such a product, ensure the setting is blank.
- ID
- SV-256423r959010_rule
- Version
- ESXI-70-000062
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Click "Edit". Select the "Net.DVFilterBindIpAddress" value and remove any incorrect addresses.