The VMM must maintain a separate execution domain for each executing process.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-207496	SRG-OS-000408	SRG-OS-000408-VMM-001670	SV-207496r958878_rule	2024-12-06	2

Description
VMMs can maintain separate execution domains for each executing process by assigning each process a separate address space. Each VMM process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial VMMs that employ multistate processor technologies.

Description

VMMs can maintain separate execution domains for each executing process by assigning each process a separate address space. Each VMM process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial VMMs that employ multistate processor technologies.

ℹ️ Check
Verify the VMM maintains a separate execution domain for each executing process. If it does not, this is a finding.

✔️ Fix
Configure the VMM to maintain a separate execution domain for each executing process.