VMware wil disable Transparant Page Sharing by default in future ESXi releases

VMware ESXi has an interesting feature called Transparent Page Sharing (TPS). TPS allows a deduplication of host memory. Typically virtual machine guest operating systems share a lot of common code. TPS basically scans on duplicate code in the host memory, make sure only 1 instance of code is loaded while pointers in memory of guests point to that instance.

The effect is savings on host memory and a better density. The result is lower costs per virtual machine.

VMware announced however it will disable TPS by default in future ESXi release because of security concerns.

VMware has released a knowledgebase article saying:

This article acknowledges the recent academic research that leverages Transparent Page Sharing (TPS) to gain unauthorized access to data under certain highly controlled conditions and documents VMware’s precautionary measure of no longer enabling TPS in upcoming ESXi releases. At this time, VMware believes that the published information disclosure due to TPS between virtual machines is impractical in a real world deployment.
Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try and determine an AES encryption key in use on another virtual machine running on the same physical processor of the host server if Transparent Page Sharing is enabled. This technique works only in a highly controlled system configured in a non-standard way that VMware believes would not be recreated in a production environment.
Even though VMware believes information being disclosed in real world conditions is unrealistic, out of an abundance of caution upcoming ESXi Update releases will no longer enable TPS between Virtual Machines by default.

 

Andrea Mauro published a very well written blog about TPS and explaining some other caveats.

This paper in detail explains the security concerns when using TPS. The abstract of the paper reads:

 

TPS

Add a Comment

Your email address will not be published. Required fields are marked *

Current ye@r *