A vm-admin can inject crafted XML into VM.other_config:disks, which is parsed via Xml.parse_string during template provisioning at xapi_templates.ml:103-104. The parser expects a <provision><disk .../></provision> structure and extracts device, size, sr, bootable, and type attributes. By injecting malformed XML, an attacker can cause denial of service via parse errors. By injecting well-formed but malicious XML, an attacker can target specific SRs for VDI creation (SR targeting), specify extreme disk sizes to exhaust storage, or inject unexpected disk configurations. The key has no per-key RBAC protection beyond the vm-admin method-level check.
VM.other_config is a Map(String, String) field writable by vm-admin. The disks key is parsed as raw XML during template clone and provisioning operations.
The code path:
vm-admin calls VM.add_to_other_config(vm, "disks", "<malicious XML>")(* xapi_templates.ml:103-104 *)
disks_of_xml (Xml.parse_string (List.assoc disks_key other_config))
disk_of_xml extracts attributes: device, size, sr, bootable, type| Vector | Mechanism | Impact |
|---|---|---|
| Malformed XML | Xml.parse_string raises exception on invalid XML |
Denial of service - template provisioning fails |
| Extreme size | size attribute set to very large value |
Storage exhaustion on target SR |
| SR targeting | sr attribute set to specific SR UUID |
VDIs created on attacker-chosen SR (bypassing intended placement) |
| Disk count inflation | Many <disk> elements in the XML |
Resource exhaustion via mass VDI creation |
Missing RBAC protection. VM.other_config has zero map_keys_roles entries for the disks key. vm-admin can write arbitrary values.
Structural validation only. Xml.parse_string validates XML syntax but does not enforce a schema. Any well-formed XML is accepted. No validation on attribute values (size range, SR existence, device validity).
Backend trust assumption. xapi_templates.ml assumes the disks key contains legitimate provisioning data set by a trusted template creator.
| Scenario | Impact | Pre-conditions | Status |
|---|---|---|---|
| Provisioning DoS | Template clone/provisioning fails with XML parse error | vm-admin, template provisioning workflow | Source-traced |
| Storage exhaustion | VDIs with extreme sizes created on target SR | vm-admin, template provisioning | Source-traced |
| SR targeting | VDIs created on attacker-chosen SR instead of intended SR | vm-admin, knowledge of SR UUIDs | Source-traced |
| Resource exhaustion | Mass VDI creation via many <disk> elements |
vm-admin, template provisioning | Modeled |
VM.other_config writes for the disks key from API usersdisks values that do not match the expected <provision><disk .../></provision> structuredisclosure/vendor-detection-guidance.mddisks values in other_configSchema validation. Validate the disks XML against a strict schema before parsing. Reject any XML that does not conform to the expected <provision><disk .../></provision> structure.
Attribute validation. Validate size against reasonable bounds. Validate sr against the set of SRs the user is authorized to access. Validate device against known device positions.
Add map_keys_roles. Protect disks in datamodel.ml at _R_POOL_ADMIN to prevent vm-admin from modifying template provisioning specifications.
Upstream patches exist. They are held privately pending coordinated disclosure.
Disclosure:
xapi_templates.ml:103-104 (XML parsing), xapi_templates.ml:63-117 (disk_of_xml attribute extraction), datamodel.ml (VM field definition)disclosure/advisories/voc-security-advisory.md (VOC-3)research/investigations/vm-other-config.mdDiscovered and reported by Jakob Wolffhechel, Moksha.