MOKSHA-2026-0039: Filesystem Layout Manipulation via SR.sm_config nosubdir/subdir

Summary

A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the filesystem layout of NFS and MooseFS storage repositories by modifying the nosubdir or subdir key in SR.sm_config after SR creation. Changing nosubdir from false to true (or vice versa) on an NFS SR causes the driver to look for VDIs in the wrong directory. All VDIs appear to not exist, causing VM boot failures and complete data inaccessibility. The attack is reversible by restoring the correct value but causes service disruption for all VMs on the affected SR. The sm_config field has zero map_keys_roles entries, and these keys are intended to be set once during SR.create but remain writable.

Vulnerability Description

SR.sm_config is a Map(String, String) field writable by pool-operator. The nosubdir key (NFS) and subdir key (MooseFS) control whether the SR driver stores VDIs in a per-SR subdirectory on the remote filesystem or in the root of the shared export.

The code path:

1. During SR.create, the SM driver sets sm_config:nosubdir based on the creation parameters
2. NFSSR.__init__() reads self.nosubdir = self.sm_config.get('nosubdir') == "true" (NFSSR.py:95)
3. Path construction uses the flag: not self.nosubdir and sr_uuid or "" (NFSSR.py:100)
4. A pool-operator changes nosubdir from "false" to "true" (or vice versa)
5. On next SR scan or VDI operation, the driver constructs paths pointing to the wrong location
6. VDI files are not found at the expected path - all VDIs appear missing

For NFS SRs:

• nosubdir=false (default): VDIs stored at <mountpoint>/<sr-uuid>/
• nosubdir=true: VDIs stored at <mountpoint>/

Flipping this flag causes the driver to look for VDIs in the wrong directory. The VDI files still exist on disk but are invisible to the driver.

The same pattern applies to MooseFS SRs via the subdir key (MooseFSSR.py).

Root Causes

1. Missing field immutability. SR.sm_config is qualifier:RW despite containing keys that define the SR's physical layout and should be immutable after creation.

2. Missing RBAC protection. SR.sm_config has zero map_keys_roles entries. The nosubdir and subdir keys inherit the class default _R_POOL_OP.

3. No consistency check. The driver does not verify that VDI files exist at the computed path before reporting them as missing. A simple existence check at the alternate location would detect the misconfiguration.

4. Mutable layout metadata. The physical layout of an SR (subdirectory vs. root) is a creation-time decision. Storing it in a mutable field allows post-creation corruption.

Affected Systems

Directly Affected

• XenServer / Citrix Hypervisor - all versions (shared SM driver codebase)
• XCP-ng - all versions (confirmed on 8.3.0)

Indirectly Affected

• All VMs on affected NFS/MooseFS SRs - VM boot failures due to missing VDIs
• NFS storage servers - VDI files remain on disk but are inaccessible to the hypervisor
• Backup and DR systems - cannot access VDIs during the disruption window

Exploitation Scenarios

Detection

• Monitor SR.sm_config for modifications to nosubdir or subdir keys after SR creation
• Alert on VDI scan failures on NFS/MooseFS SRs that previously had healthy VDIs
• Compare SR.sm_config snapshots between monitoring intervals for drift
• See rule S-09 in disclosure/vendor-detection-guidance.md

Remediation

Short-Term Mitigations

• Audit all SR.sm_config records on NFS/MooseFS SRs: verify nosubdir/subdir matches the actual filesystem layout
• Take periodic snapshots of SR.sm_config to detect unauthorized changes
• If VDIs become invisible, check the alternate directory path before assuming data loss

Long-Term Fix

Enforce sm_config immutability. Driver-set keys like nosubdir and subdir should be immutable after SR.create. Implement a write-once mechanism for layout-defining keys.

Add map_keys_roles. Protect nosubdir and subdir at _R_LOCAL_ROOT_ONLY in datamodel.ml.

Add consistency verification. When a VDI scan finds no VDIs at the expected path, check the alternate path (with/without subdirectory) and log a warning if VDIs exist at the alternate location.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

• Public release: 2026-04-24 08:00 CEST
• CERT/CC notified: 2026-04-23
• MITRE CVE reservation filed: 2026-04-09 (no response as of publication)
• EU CVE registers notified: 2026-04-18 (GCVE/CIRCL, ENISA, DIVD - no response)
• Vendor (Cloud Software Group / Citrix): not contacted pre-publication
• Downstream maintainer (Vates/XCP-ng): contacted 2026-04-23 with conditional patch offer

References

• XAPI source: datamodel.ml:4949-4953 (SR.sm_config field definition), NFSSR.py:95 (nosubdir read), NFSSR.py:100 (path construction using nosubdir flag)
• Thematic advisory: disclosure/advisories/ssmc-security-advisory.md (SSMC-4)
• Investigation: research/investigations/sr-sm-config.md

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.