A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can enable promiscuous mode on a VIF's bridge port by setting VIF.other_config:promiscuous to true. The VIF hotplug script writes 1 to /sys/class/net/vifX.Y/brport/promisc, causing the guest VM to receive all frames on the Linux bridge - including traffic destined for other VMs. This enables cross-VM traffic sniffing in any multi-tenant environment using Linux bridge networking. The key has no per-key RBAC protection, the attack requires a single API call, and no security alert is generated.
VIF.other_config is a Map(String, String) field writable by vm-admin. The promiscuous key is consumed by the VIF hotplug script (vif-real) during VIF plug operations.
The code path:
vm-admin calls VIF.add_to_other_config(vif, "promiscuous", "true")vif-real hotplug script reads the key at lines 66-821 to /sys/class/net/vifX.Y/brport/promiscThe guest VM now receives a copy of every frame traversing the bridge, including traffic destined for other VMs on the same bridge.
Open vSwitch does not support promiscuous mode via this sysfs path. On OVS-backed networks, the sysfs write has no effect. However, this protection is accidental (ARCH-5 pattern) - OVS was not chosen for its security properties here, and there is no enforcement preventing an administrator from using Linux bridge networking.
Missing RBAC protection. VIF.other_config has zero map_keys_roles entries in datamodel.ml. The promiscuous key is writable by vm-admin via add_to_other_config.
Missing consumer-side validation. The vif-real hotplug script accepts the promiscuous flag without any authorization check or security-level logging.
set_other_config RBAC bypass. The set_other_config method replaces the entire map atomically and bypasses map_keys_roles per-key checks entirely.
Insufficient logging. No security alert is generated when promiscuous mode is enabled on a VIF.
| Scenario | Impact | Pre-conditions | Status |
|---|---|---|---|
| Cross-VM traffic capture | Read all frames on the bridge, including other VMs' traffic | Linux bridge networking, vm-admin credential | Source-traced, RBAC confirmed |
| Credential sniffing | Capture unencrypted credentials (HTTP, SMTP, FTP) from co-hosted VMs | Unencrypted protocols in use | Modeled |
| Reconnaissance | Map internal network topology, identify services, enumerate hosts | Linux bridge, multiple VMs | Modeled |
| Chained with BOC-1 | After RBAC collapse via BOC-1, enable promiscuous mode on any VIF in the pool | BOC-1 available | Modeled (amplification chain) |
VIF.other_config for promiscuous=true or promiscuous=on entries/sys/class/net/vif*/brport/promisc for non-zero valuesdisclosure/vendor-detection-guidance.mdVIF.other_config records for promiscuous keysAdd map_keys_roles. Protect promiscuous in datamodel.ml at _R_POOL_ADMIN to prevent vm-admin from enabling promiscuous mode.
Consumer-side validation. The vif-real hotplug script should reject promiscuous mode requests unless explicitly authorized by pool-level policy.
Upstream patches exist. They are held privately pending coordinated disclosure.
Disclosure:
vendor/xenopsd/scripts/vif-real:66-82 (promiscuous mode sysfs write), datamodel.ml (VIF field definition)disclosure/advisories/vif-security-advisory.md (VIOC-2)research/investigations/vif-other-config.mdDiscovered and reported by Jakob Wolffhechel, Moksha.