Title

The VMM must maintain a separate execution domain for each guest VM. (Cat II impact)

Discussion

VMMs can maintain separate execution domains for each executing guest VM by assigning each guest VM a separate address space. Each VMM guest VM has a distinct address space so that communication between guest VMs is performed in a manner controlled through the security functions of the VMM, and one guest VM cannot modify the executing code of another guest VM. This capability is available in most commercial VMMs that employ virtualization processor technologies.

Check Content

Verify the VMM maintains a separate execution domain for each guest VM. If it does not, this is a finding.

Fix Text

Configure the VMM to maintain a separate execution domain for each guest VM.

Additional Identifiers

Rule ID: SV-207497r958878_rule

Vulnerability ID: V-207497

Group Title: SRG-OS-000408

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.