Secure Boot for VMWare

Secure Boot for ESXi 6.5 – Hypervisor Assurance
Mike Foley
I’ve talked about how vSphere has been moving towards a “secure by default” stance over the past few years. This can clearly be seen in the new vSphere 6.5 Security Configuration Guide where the number of  “hardening” steps are growing smaller with every release. In this blog post we will go over another “secure by default” feature of vSphere 6.5 that provides hypervisor assurance, Secure Boot for ESXi. One of the coolest things in 6.5,  in my opinion, is the adoption of Secure Boot for ESXi. Now, you might say “But my laptop has had Secure Boot  since Windows 8, what’s the big deal?” Well, the “big deal” is that we’ve gone beyond the default behavior of Secure Boot and we now leverage the capabilities of the UEFI firmware to ensure that ESXi not only boots with a signed bootloader validated by the host firmware but that it also ensures that unsigned code won’t run on the hypervisor. Best of all, it’s simple to implement! Let’s dive in![…]




VMWare and UEFI Secure Boot

Stephen J. Bigelow has an article in TechTarget.com on VMWare and Secure Boot:

VMware vSphere 6.5 takes an extra security step, building on UEFI secure boot with added cryptographic validation to all ESXi components. VMware vSphere 6.5 added numerous features designed to improve the security of virtual machines both at rest and…[…]

You’ll have to give TechTarget.com your email address to read the article. 😦



Secure Boot in vSphere 6.5

Tom Fenton has an article in Virtualization Review on the latest version of VMWare’s vSphere 6.5, and this release includes UEFI changes:

[…]Another major security upgrade in this release is “Secure Boot,” to prevent unauthorized operating systems and software from loading during the startup process. Secure Boot is a feature enabled by UEFI, and can be used not only when booting the hypervisor, but also when booting up the guests. VMware has also updated its logging to include the ability to track who did what on a vSphere system. […]



UEFI firmware patch for VMware workstation

The earlier post on this was when the project was a new project with no code. They have code now, which consists of a few shell scripts and a patch to linux/driver.c. Presume this is unofficial. 🙂

“This is a program to patch VMware Workstation 12 kernel modules and to sign them using a X.509 key and enrolling the key in the system UEFI firmware.”




VMware UEFI firmware key patch

This project just got created on Github.  No code yet, but only an hour old. If you are into VMware and UEFI, you might want to watch for this project to evolve.

VMware Workstation Kernel Modules Signing Patch
This is a program to patch VMware Workstation 12 kernel modules and to sign them using a X.509 key and enrolling the key in the system UEFI firmware.




Business changes at EMC, impacting VMWare, multiple news sites with stories on it.


VMware Takes Restructuring Charge, Changes CFOs






VMware vulnerability

VMware ESXi, Fusion, Player, and Workstation updates address important guest privilege escalation vulnerability

VMware Security Advisory
Advisory ID:     VMSA-2016-0001
Synopsis:     VMware ESXi, Fusion, Player, and Workstation updates address important guest privilege escalation vulnerability
Updated on:     2016-01-07 (Initial Advisory)
CVE numbers:     CVE-2015-6933

VMware ESXi 6.0 without patch ESXi600-201512102-SG
VMware ESXi 5.5 without patch ESXi550-201512102-SG
VMware ESXi 5.1 without patch ESXi510-201510102-SG
VMware ESXi 5.0 without patch ESXi500-201510102-SG
VMware Workstation prior to 11.1.2
VMware Player prior to 7.1.2
VMware Fusion prior to 7.1.2

VMware would like to thank Dmitry Janushkevich from the Secunia Research Team for reporting this issue to us.

See full announcement for more information, including patch/workarounds.