Virtual machines (VMs) must disable DirectPath I/O devices when not required.
An XCCDF Rule
Description
VMDirectPath I/O (PCI passthrough) enables direct assignment of hardware PCI functions to VMs. This gives the VM access to the PCI functions with minimal intervention from the ESXi host. This is a powerful feature for legitimate applications such as virtualized storage appliances, backup appliances, dedicated graphics, etc., but it also allows a potential attacker highly privileged access to underlying hardware and the PCI bus.
- ID
- SV-258727r959010_rule
- Version
- VMCH-80-000214
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
From the vSphere Client, select the Virtual Machine, right-click and go to Edit Settings >> Virtual Hardware tab.
Find the unexpected PCI device returned from the check.
Hover the mouse over the device and click the circled "X" to remove the device. Click "OK".