Details
ESXi hosts by default do not permit the loading of kernel modules that lack valid digital
signatures. This feature can be overridden which would result in unauthorized kernel
modules to be loaded.
*Rationale*
VMware provides digital signatures for kernel modules. By default the ESXi host does not
permit loading of kernel modules that lack a valid digital signature. However, this behavior
can be overridden allowing unauthorized kernel modules to be loaded. Untested or
malicious kernel modules loaded on the ESXi host can put the host at risk for instability
and/or exploitation.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
To implement the recommended configuration state, run the following PowerCLI
command-# To disable a module-
$ESXCli = Get-EsxCli -VMHost MyHost
$ESXCli.system.module.set($false, $false, ‘MyModuleName’)
Note- evacuate VMs and place the host into maintenance mode before disabling kernel
modules.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.