← Back to Virtual Machine Manager Security Requirements Guide

V-207497

CAT II (Medium)

The VMM must maintain a separate execution domain for each guest VM.

Rule ID

SV-207497r1138013_rule

STIG

Virtual Machine Manager Security Requirements Guide

Version

V2R3

CCIs

CCI-002530

Discussion

VMMs can maintain separate execution domains for each executing guest VM by assigning each guest VM a separate address space. Each VMM guest VM has a distinct address space so that communication between guest VMs is performed in a manner controlled through the security functions of the VMM, and one guest VM cannot modify the executing code of another guest VM. This capability is available in most commercial VMMs that employ virtualization processor technologies. This requirement also applies to Zero Trust initiatives.

Check Content

Verify the VMM maintains a separate execution domain for each guest VM.

If it does not, this is a finding.

Fix Text

Configure the VMM to maintain a separate execution domain for each guest VM.