Details
Disable unexposed Host Guest File System Server.
*Rationale*
Certain automated operations such as automated tools upgrades use a component into the
hypervisor called Host Guest File System (HGFS) and an attacker could potentially use this
to transfer files inside the guest OS. These VMX parameters don’t apply on vSphere because
VMware virtual machines work on vSphere and hosted virtualization platforms such as
Workstation and Fusion. The code paths for these features are not implemented in ESXi.
Explicitly disabling these features reduces the potential for vulnerabilities because it
reduces the number of ways in which a guest can affect the host. Note that these are
implemented in code or not, must have a value.
Solution
To implement the recommended configuration state, run the following PowerCLI
command-# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name ‘isolation.tools.hgfsServerSet.disable’ -value
$true
Impact-This will cause the VMX process to not respond to commands from the tools process. It may
also have a negative impact on operations such as automated tools upgrades. Setting
isolation.tools.hgfsServerSet.disable to TRUE disables the registration of the guest’s HGFS
server with the host. APIs that use HGFS to transfer files to and from the guest operating
system, such as some VIX commands or the VMware Tools auto-upgrade utility, will not
function.
Default Value-The prescribed state is not the default state.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.