8.6.3 Disable virtual disk wiping

Information

If Virtual disk wiping is done repeatedly, it will cause the virtual disk to become unavailable
resulting in a denial of service. You can prevent virtual disk wiping by disabling it.

*Rationale*

Wiping a virtual disk reclaims ALL unused space in it. If there is empty space in the disk,
this process reduces the amount of space the virtual disk occupies on the host drive.
Normal users and processes that is, users and processes without root or administrator
privileges within virtual machines have the capability to invoke this procedure. However,
if this is done repeatedly, the virtual disk can become unavailable while this wiping is being
performed, effectively causing a denial of service. In most datacenter environments, disk
wiping is not done, so you should disable this feature. Repeated disk wiping can make a
virtual disk unavailable. This capability is available to nonadministrative users in the guest.

Solution

To implement the recommended configuration state, run the following PowerCLI
command-
# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.tools.diskWiper.disable' -value $true

Impact-When you disable this feature, you cannot wipe virtual machine disks when a datastore
runs out of space.

Default Value-The prescribed state is not the default state.

See Also

https://workbench.cisecurity.org/files/145

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7

Plugin: VMware

Control ID: 5213bd4b6238846f5db0163aaee54d9c1d52b28b6ff5ca5fdd7fae11d35e2610