The ESXi host must not suppress warnings about unmitigated hyperthreading vulnerabilities.
An XCCDF Rule
Description
The L1 Terminal Fault (L1TF) CPU vulnerabilities published in 2018 have patches and mitigations available in vSphere. However, there are performance impacts to these mitigations that require careful thought and planning from the system administrator before implementation. Until a mitigation is implemented, the UI warning about the lack of a mitigation must not be dismissed so the SA does not assume the vulnerability has been addressed.
- ID
- SV-256433r959010_rule
- Version
- ESXI-70-000081
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Click "Edit". Select the "UserVars.SuppressHyperthreadWarning" value and set it to "0".