A pool-operator can inject an arbitrary block device path via PBD.device_config:device when creating an EXT or LVM SR. The SM driver reads the path unchecked and passes it to pvcreate and vgcreate, which execute destructive operations on the attacker-chosen device. LVHDSR has a systemroot check that blocks the immediate host root device, but this check does not protect other partitions, additional disks, remote block devices, or other VMs' local storage. The result is data destruction on arbitrary block devices accessible to the host.
When creating an EXT or LVM SR, the SM driver reads device_config:device to determine which block device to initialize as a storage repository. The value flows from the XAPI database to LVM subprocess calls without adequate validation.
SR.create(device_config={device: "/dev/sdb"})
-> PBD stored with unchecked device path
-> PBD.plug() triggers LVHDSR.create()
-> LVHDSR.create() reads self.dconf['device'] (line 457)
-> lvutil.createVG() called with attacker device path (line 508)
-> pvcreate /dev/sdb
-> vgcreate <sr-uuid> /dev/sdb
-> Block device is now an LVM physical volume (original data destroyed)
LVHDSR implements a systemroot check at lines 467-470 that compares the requested device against the host's root device. This prevents targeting /dev/sda (or whatever device hosts the root filesystem). However, the check has several gaps:
/dev/sda2, /dev/sda3 are not protected/dev/sdb, /dev/sdc, etc. are not protected/dev/mapper/* paths bypass the checkpvcreate overwrites the first sectors of the target device with LVM metadata. This is a destructive operation that renders the previous contents of the device unrecoverable without backup. vgcreate then creates a volume group on the device, completing the initialization. Both operations execute as root.
Inadequate device validation. The systemroot check protects only the immediate root device. It does not implement a comprehensive device allowlist.
No device ownership verification. The SM driver does not verify that the requested device is unpartitioned, unused, or intended for SR creation.
Destructive operation on unvalidated input. pvcreate is a destructive operation that should only execute on devices explicitly approved for storage initialization.
| Scenario | Impact | Pre-conditions | Status |
|---|---|---|---|
| Non-root partition destruction | Destroy data on host partitions other than root | Target host has additional partitions | ALL PASS (live-tested) |
| Secondary disk destruction | Destroy data on secondary disk (e.g., local backup disk) | Target host has additional disks | ALL PASS (live-tested) |
| Remote LUN targeting | Destroy data on an iSCSI LUN presented to the host | iSCSI LUN accessible | Modeled (follows from same code path) |
| BOC-1 chain | vm-admin escalates to pool-operator via BOC-1 S3, then targets any device | BOC-1 available | Modeled (two-step chain) |
SR.create calls for device_config:device values targeting unexpected block devicespvcreate or vgcreate invocations targeting devices outside the authorized listpool-operator role grants to trusted storage administratorsBlock device allowlist. Expand the systemroot check in LVHDSR to reject all devices not on an explicit allowlist. Default policy: only unused, unpartitioned block devices that are not mounted and not part of any existing volume group.
Device ownership verification. Before executing pvcreate, verify that the target device is truly available for SR creation: not mounted, not in an existing VG, not a partition on a system disk.
Confirmation step. Require an explicit confirmation for destructive device initialization, independent of the API call that creates the SR.
Upstream patches exist. They are held privately pending coordinated disclosure.
Disclosure:
LVHDSR.py:457 (device_config read), LVHDSR.py:467-470 (systemroot check), lvutil.py:createVG() (pvcreate/vgcreate execution)disclosure/advisories/pdc-security-advisory.md (PDC-5)research/investigations/pbd-device-config.mdresearch/pdc-5/poc/pdc-5-block-device-injection.py (available to CSIRTs on request)pdc-5-block-device-injection-20260321-234547.logDiscovered and reported by Jakob Wolffhechel, Moksha.