The VMM must maintain a separate execution domain for each executing process.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207496	SRG-OS-000408-VMM-001670	SV-207496r958878_rule		Medium

Description
VMMs can maintain separate execution domains for each executing process by assigning each process a separate address space. Each VMM process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial VMMs that employ multistate processor technologies.

Description

VMMs can maintain separate execution domains for each executing process by assigning each process a separate address space. Each VMM process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial VMMs that employ multistate processor technologies.

STIG	Date
Virtual Machine Manager Security Requirements Guide	2024-05-28

Details

Check Text ( C-7753r365892_chk )
Verify the VMM maintains a separate execution domain for each executing process. If it does not, this is a finding.

Fix Text (F-7753r365893_fix)
Configure the VMM to maintain a separate execution domain for each executing process.