MOKSHA-2026-0015: VHD Format Flag Corruption via SR.sm_config use_vhd

Advisory IDMOKSHA-2026-0015
Semantic IDSSMC-2
Published2026-04-24
CVSS 3.17.6 High
CVSS 3.1 VectorAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS 4.08.4 High
CVSS 4.0 VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N
XAPI ObjectSR
XAPI Fieldsm_config:use_vhd
Entry Rolepool-operator
ResearcherJakob Wolffhechel, Moksha

Affected Products

VendorProductVersions
Citrix / Cloud Software GroupXenServer / Citrix Hypervisorall versions (shared XAPI codebase)
VatesXCP-ng8.3.0

Summary

A pool-operator can cause complete data loss for all VDIs on an LVHD storage repository by removing the use_vhd key from SR.sm_config. This key tells the LVHDSR driver whether VDIs are stored in VHD format or raw LV format. Removing it on a VHD-mode SR causes the driver to operate in legacy raw LV mode on the next PBD plug cycle. VHD-format VDIs read as raw LVs produce garbage data. Raw LVs read as VHD fail header validation. The result is complete data loss for every VDI on the affected SR.

Vulnerability Description

SR.sm_config is a Map(String, String) field writable by pool-operator with zero map_keys_roles entries. The use_vhd key is set by the LVHDSR driver during SR.create and is consumed during LVHDSR.load() to determine the storage format for all VDIs on the SR.

Data Flow

pool-operator calls SR.remove_from_sm_config(sr, "use_vhd")
  -> sm_config updated in XAPI database (key removed)
  -> Next PBD plug (reboot, HA failover, manual unplug/plug):
     -> LVHDSR.load() reads sm_config
     -> use_vhd key missing -> driver falls back to raw LV mode
     -> VHD-format VDIs accessed as raw LVs
     -> VHD headers misinterpreted as data -> garbage output
     -> Raw-mode writes corrupt VHD metadata -> unrecoverable

Dormancy

The corruption does not take effect immediately. The LVHDSR driver reads sm_config during LVHDSR.load(), which occurs at PBD plug time - not continuously. The corrupted state lies dormant until the next PBD cycle: host reboot, HA failover, storage maintenance, or manual PBD unplug/plug. In production, this dormancy period can span days to months.

Irreversibility

Once the driver operates in raw LV mode on VHD-format VDIs:

Root Causes

  1. Missing key immutability. SR.sm_config keys written by the SM driver during SR.create remain user-writable at runtime. No mechanism enforces immutability of driver-set configuration.

  2. Zero map_keys_roles entries. The use_vhd key has no per-key RBAC protection. Any pool-operator can remove it.

  3. Missing write-time validation. No check prevents removal of use_vhd on a VHD-mode SR. The key should be either immutable or validated against the actual SR format.

  4. Silent fallback. The driver silently falls back to raw LV mode when use_vhd is missing, rather than failing safely with an error.

Affected Systems

Directly Affected

Storage Drivers Affected

Impact Scope

Exploitation Scenarios

Scenario Impact Pre-conditions Status
VHD format flag removal Complete data loss for all SR VDIs on next PBD cycle VHD-mode LVHD SR Code-traced (LVHDSR.py format switch path confirmed)
Delayed detonation Corruption dormant until reboot/failover Standard production operation Code-traced (load-time-only read confirmed)
BOC-1 chain vm-admin escalates to pool-operator via BOC-1 S3, then removes use_vhd BOC-1 available Modeled (two-step chain)

Detection

Remediation

Short-Term Mitigations

Long-Term Fix

Key immutability. Enforce immutability for driver-written SR.sm_config keys. Once set by the SM driver during SR.create, keys should not be modifiable via the API.

Add map_keys_roles. Protect use_vhd at _R_LOCAL_ROOT_ONLY to prevent any API user from modifying it.

Validate use_vhd as boolean. Reject removal on VHD-mode SRs. The driver should refuse to load if use_vhd is absent on an SR that was created in VHD mode.

Fail-safe behavior. When use_vhd is missing, the driver should refuse to load rather than silently falling back to raw LV mode.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

References

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.

Jakob Wolffhechel · Moksha · Copenhagen
jakob@wolffhechel.dk · +45 3170 7337
Published 2026-04-24 08:00 CEST · cna.moksha.dk · shittrix.moksha.dk