VMCI Device Always Enabled

The VMCI device is always present in recently created VMware virtual machines, raising questions about the security implications of having a VMCI device.

VMCI and Hardware Version

Starting with VMware virtual hardware version 7, the VMCI device is enabled by default. Virtual machines upgraded from older hardware versions to version 7 acquire the VMCI device even if it was not present before upgrading the virtual hardware. The VMCI device cannot be removed. On most guest operating systems, VMware Tools should be installed to provide a VMCI device driver.

To address security concerns, VMware provided a method to restrict VMCI-based services that are available to a virtual machine. Services were restricted to a trusted subset of only the hypervisor-related services needed to run a virtual machine in isolation. Restricted was the default, as is now the only configuration.

Authentication

All VMCI communications are authenticated. The source (context ID) may not be spoofed. The VMCI facility implicitly authenticates any hypervisor service as being part of the trusted code base. VMCI does not provide fine grained authentication of communication endpoints, so applications must deal with fine grained authentication as a separate issue. It is the responsibility of applications running on top of VMCI to implement their own authentication mechanisms if necessary. VMCI ensures only that malicious software cannot spoof the source field in VMCI datagrams identifying the sending virtual machine.

Isolation Options in VMX

ESX/ESXi 4.0 to ESXi 5.0 provide .vmx options for VMCI isolation. As of ESXi 5.1, these options have no effect.

[vmci0.unrestricted = FALSE|TRUE]

(Ignored now.) When its vmci.unrestricted option was set TRUE, a virtual machine could communicate with all host endpoints and other virtual machines with vmci0.unrestricted set TRUE.

[vmci0.domain = <domainName>]

(ESX/ESXi only) All virtual machines and host applications were members of the default domain ("") null string, by default. If the vmci0.domain option specified a non-default domain, then the virtual machine could communicate only with the hypervisor and other virtual machines in the same domain. This was to organize virtual machines into groups that could communicate with each other.

On ESXi 5.1 and later, the VMCI device always has a security profile similar to other devices such as keyboard, video monitor, and mouse. In earlier releases, the VMCI device could be a security risk guest-to-guest when vmci0.unrestricted was explicitly set TRUE, although VMCI in itself did not expose any guest information.