The VMM must maintain a separate execution domain for each guest VM.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207497	SRG-OS-000408-VMM-001680	SV-207497r958878_rule		Medium

Description
VMMs can maintain separate execution domains for each executing guest VM by assigning each guest VM a separate address space. Each VMM guest VM has a distinct address space so that communication between guest VMs is performed in a manner controlled through the security functions of the VMM, and one guest VM cannot modify the executing code of another guest VM. This capability is available in most commercial VMMs that employ virtualization processor technologies.

Description

VMMs can maintain separate execution domains for each executing guest VM by assigning each guest VM a separate address space. Each VMM guest VM has a distinct address space so that communication between guest VMs is performed in a manner controlled through the security functions of the VMM, and one guest VM cannot modify the executing code of another guest VM. This capability is available in most commercial VMMs that employ virtualization processor technologies.

STIG	Date
Virtual Machine Manager Security Requirements Guide	2024-05-28

Details

Check Text ( C-7754r365895_chk )
Verify the VMM maintains a separate execution domain for each guest VM. If it does not, this is a finding.

Fix Text (F-7754r365896_fix)
Configure the VMM to maintain a separate execution domain for each guest VM.