The VMM must maintain a separate execution domain for each executing process.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-207496 | SRG-OS-000408-VMM-001670 | SV-207496r958878_rule | CCI-002530 | medium |
| Description | ||||
| VMMs can maintain separate execution domains for each executing process by assigning each process a separate address space. Each VMM process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial VMMs that employ multistate processor technologies. | ||||
| STIG | Date | |||
| Virtual Machine Manager Security Requirements Guide | 2024-12-06 | |||
Details
Check Text (C-207496r958878_chk)
Verify the VMM maintains a separate execution domain for each executing process.
If it does not, this is a finding.
Fix Text (F-7753r365893_fix)
Configure the VMM to maintain a separate execution domain for each executing process.