8.4.21 Ensure Host Guest File System Server is disabled

Information

The Host Guest File System Server should be disabled if it is not needed.

*Rationale*

Certain automated operations such as automated tools upgrades use a component into the
hypervisor called Host Guest File System (HGFS) and an attacker could potentially use this
to transfer files inside the guest OS. These VMX parameters don't apply on vSphere because
VMware virtual machines work on vSphere and hosted virtualization platforms such as
Workstation and Fusion. The code paths for these features are not implemented in ESXi.
Explicitly disabling these features reduces the potential for vulnerabilities because it
reduces the number of ways in which a guest can affect the host. Note that these are
implemented in code or not, must have a value.

Solution

To disable the Host Guest File System Server, run the following PowerCLI command:
# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.tools.hgfsServerSet.disable' -value
$true

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv7|9.2

Plugin: VMware

Control ID: cb2ce0bd61fcaab5971250861b43b718ec216a1fede2f489300c8cb8fbb09087