MOKSHA-2026-0024: NFS Mount Option Injection via PBD.device_config

Summary

A pool-operator can inject arbitrary NFS mount options via PBD.device_config:options when creating or reconfiguring an NFS storage repository. The NFSSR driver appends these options directly to the mount.nfs command without sanitization. An attacker can inject sec=none (disable NFS authentication), noac (disable attribute caching - performance denial of service), or ro (force read-only) to weaken storage security or degrade performance. The attack was confirmed via live testing with all checks passing.

Vulnerability Description

PBD.device_config is the storage connection string for all SM drivers in XAPI-based hypervisors. The options key is consumed by the NFSSR driver during mount operations.

The data flow:

1. pool-operator calls SR.create() with device_config = {server: "nfs-server", serverpath: "/export", options: "noac"}
2. XAPI stores the PBD record with the unchecked options value
3. On PBD.plug(), NFSSR reads device_config["options"]
4. nfs.soft_mount() appends the options directly to the mount.nfs command: mount.nfs server:/export /mountpoint -o soft,noac
5. The attacker-controlled mount options take effect

No validation occurs on the options value. Any string accepted by mount.nfs is applied.

Dangerous Options

Root Causes

1. Missing value validation. The options key accepts arbitrary strings and forwards them directly to mount.nfs.

2. No mount option allowlist. The NFSSR driver does not maintain an allowlist of acceptable NFS mount options.

3. Architectural trust assumption. The SM driver assumes device_config contains legitimate configuration from a trusted administrator. No mechanism distinguishes malicious options from legitimate ones.

Affected Systems

Directly Affected

• XenServer / Citrix Hypervisor - all versions (shared SM driver codebase)
• XCP-ng 8.3 - confirmed (live-tested: all checks PASS)

Indirectly Affected

• NFS servers connected to affected pools - security downgraded by injected options
• All VMs using NFS storage - performance degraded or access restricted by injected options

Exploitation Scenarios

Detection

• Audit PBD.device_config for NFS SRs containing the options key
• Alert on mount options outside a known-safe set (e.g., soft, tcp, timeo, retrans)
• Monitor NFS mount parameters on dom0 via /proc/mounts
• See rule D-03 in disclosure/vendor-detection-guidance.md

Remediation

Short-Term Mitigations

• Audit all NFS SR device_config for unexpected options values
• Monitor /proc/mounts on each host for unexpected NFS mount options
• Restrict pool-operator role grants

Long-Term Fix

Mount option allowlist. NFSSR should only accept known-safe NFS mount options. Reject sec=none, noac, and other dangerous options.

Write-time validation. Validate the options field against an allowlist at SR.create time, before the value is stored in the PBD.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

• Public release: 2026-04-24 08:00 CEST
• CERT/CC notified: 2026-04-23
• MITRE CVE reservation filed: 2026-04-09 (no response as of publication)
• EU CVE registers notified: 2026-04-18 (GCVE/CIRCL, ENISA, DIVD - no response)
• Vendor (Cloud Software Group / Citrix): not contacted pre-publication
• Downstream maintainer (Vates/XCP-ng): contacted 2026-04-23 with conditional patch offer

References

• Related MOKSHA IDs: MOKSHA-2026-0001 (BOC-1 RBAC collapse enables vm-admin to reach this vector)
• XAPI source: NFSSR driver nfs.soft_mount() (mount option passthrough), SRCommand.parse() (device_config read)
• Thematic advisory: disclosure/advisories/pdc-security-advisory.md (PDC-3)
• Investigation: research/investigations/pbd-device-config.md
• PoC evidence: research/pdc-3/poc/evidence/pdc-3-nfs-mount-options-20260321-222703.log

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.