The VMM must maintain a separate execution domain for each executing process.
Overview
Finding ID
Version
Rule ID
IA Controls
Severity
V-207496
SRG-OS-000408-VMM-001670
SV-207496r958878_rule
Medium
Description
VMMs can maintain separate execution domains for each executing process by assigning each process a separate address space. Each VMM process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial VMMs that employ multistate processor technologies.