MOKSHA-2026-0045: Arbitrary Bond Property Injection via PIF.other_config bond-*

Summary

A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary bond configuration properties into OVS or Linux bonding by writing keys with the bond- prefix to PIF.other_config. The nm.ml:216-227 function extracts any key with the bond- prefix, strips the prefix, and passes the remainder as a bond property name with zero validation on property names or values. This enables bond mode changes (e.g., active-backup to balance-slb), bond timer manipulation, and injection of completely invalid parameters causing OVS errors and network disruption.

Vulnerability Description

PIF.other_config is a Map(String, String) field writable by pool-operator with zero map_keys_roles entries. The bond-* key prefix is consumed by the bond creation logic in nm.ml.

The code path:

1. pool-operator calls PIF.add_to_other_config(bond_master_pif, "bond-mode", "balance-tcp")
2. On PIF plug or bring_pif_up, nm.create_bond at nm.ml:216-227 is invoked
3. The function iterates over pif_other_config, filters keys starting with bond-:

   let overrides = List.filter_map (fun (k, v) ->
     if String.starts_with ~prefix:"bond-" k then Some (String.sub_to_end k 5, v)
     else None
   ) master_rc.API.pIF_other_config
   

4. The prefix is stripped, and the remaining key/value pair is injected as a bond property override
5. Default bond properties are replaced by the attacker-controlled values
6. Values are passed to OVS (ovs-vsctl bond configuration) or Linux bonding with no validation

This allows injection of any string as a bond property name and any string as its value. There is no whitelist of valid bond properties and no validation of values.

Root Causes

1. Missing RBAC protection. PIF.other_config has zero map_keys_roles entries. All keys, including the bond-* prefix pattern, are writable by pool-operator.

2. Missing input validation. The nm.ml:216-227 bond override mechanism accepts any key after the bond- prefix as a bond property name. No whitelist of valid bond properties is enforced. No validation of values is performed.

3. Prefix-based key consumption. The bond- prefix pattern creates an open-ended injection surface - the number of injectable properties is unbounded.

4. PIF.other_config has highest merge precedence. In the other_config merge chain (nm.ml:112-120), PIF.other_config overrides both Network.other_config and Pool.other_config. A PIF-level bond property override cannot be counteracted at the pool or network level.

Affected Systems

Directly Affected

• XenServer / Citrix Hypervisor - all versions (shared XAPI codebase)
• XCP-ng - all versions (confirmed on 8.3.0)

Indirectly Affected

• All VMs and management traffic on the bond - bond mode change disrupts traffic flow
• Storage traffic over bonded interfaces - bond timer manipulation causes I/O disruption
• HA heartbeat - management network bond disruption can trigger HA fencing

Exploitation Scenarios

Chaining Analysis

• BOC-1 + POC-1: vm-admin uses BOC-1 S3 (RBAC collapse) to reach pool-operator, then injects bond properties on the management bond to disrupt host connectivity.
• POC-1 + POC-3: Bond property injection (POC-1) combined with MTU manipulation (POC-3) creates compound network disruption - bond failover behavior changes while frame sizes become incompatible.

Detection

• Monitor PIF.other_config for keys with the bond- prefix
• Alert on bond property changes outside of planned maintenance
• Compare active bond configuration with expected settings
• See rule PI-01 in disclosure/vendor-detection-guidance.md

Remediation

Short-Term Mitigations

• Audit all PIF.other_config entries for unexpected bond-* keys
• Verify bond configurations match expected parameters after any PIF.other_config changes
• Restrict pool-operator role grants to trusted administrators

Long-Term Fix

Whitelist bond properties. Replace the open-ended bond- prefix extraction with a fixed whitelist of known valid bond properties (mode, miimon, updelay, downdelay, lacp-time).

Validate bond property values. For each whitelisted property, validate the value against the acceptable range (e.g., mode must be one of the known bond modes).

Add map_keys_roles. Protect bond-* keys at _R_POOL_ADMIN in datamodel.ml.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

• Public release: 2026-04-24 08:00 CEST
• CERT/CC notified: 2026-04-23
• MITRE CVE reservation filed: 2026-04-09 (no response as of publication)
• EU CVE registers notified: 2026-04-18 (GCVE/CIRCL, ENISA, DIVD - no response)
• Vendor (Cloud Software Group / Citrix): not contacted pre-publication
• Downstream maintainer (Vates/XCP-ng): contacted 2026-04-23 with conditional patch offer

References

• XAPI source: nm.ml:216-227 (bond property override extraction), nm.ml:112-120 (other_config merge precedence), datamodel.ml:2784-2788 (PIF.other_config field definition)
• Thematic advisory: disclosure/advisories/poc-security-advisory.md (POC-1)
• Investigation: research/investigations/pif-other-config.md

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.