MOKSHA-2026-0048: Storage Availability Disruption via Host.other_config multipathing

Summary

A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable multipath I/O redundancy on a host by writing multipathing=false to Host.other_config. The SM drivers read this key during initialization at SR.py:456-467 and switch to single-path I/O when the value is "false". Setting multipathhandle to null loads the no-op mpath_null.py module, achieving the same effect. If the single remaining storage path fails, all VMs on that storage become unavailable. The field has only UI keys protected via map_keys_roles - all infrastructure keys including multipathing are writable by pool-operator.

Vulnerability Description

Host.other_config is a Map(String, String) field writable by pool-operator. The multipathing and multipathhandle keys control the host's multipath I/O configuration for storage access.

The code path:

1. pool-operator calls Host.add_to_other_config(host, "multipathing", "false")
2. XAPI stores the value without validation
3. The event watcher thread at xapi_host_helpers.ml:601-611 detects the change and syncs to the first-class Host.multipathing field
4. On the next SR operation, SR._mpathinit() at SR.py:456-467 reads the value
5. SR.py:462 checks: if hconf.get('multipathing') == "true" - the value is now "false"
6. SR.py:465-467: multipathing is disabled, mpathhandle is set to "null"
7. The no-op mpath_null.py module is loaded, which has empty implementations of all multipath methods
8. All subsequent storage operations use single-path I/O
9. If the single path fails, storage becomes unreachable

Additionally, the multipathing key is consumed by:

• mpathcount.py:244-248 - multipath monitoring is disabled
• xapi_host_helpers.ml:601-611 - syncs to Host.multipathing first-class field, which controls /var/run/nonpersistent/multipath_enabled

Root Causes

1. Missing RBAC protection. Host.other_config only protects UI keys (folder, XenCenter.CustomFields.*) via map_keys_roles. The multipathing key inherits the class default _R_POOL_OP.

2. Missing write-time validation. No validation verifies that disabling multipathing is safe (e.g., whether multipath-dependent SRs exist on the host).

3. Silent degradation. Disabling multipathing produces no warning, no alert, and no operator notification. The storage continues to function on a single path until that path fails.

4. No operational safeguard. No check prevents disabling multipathing when the host has active SRs that depend on multiple paths for redundancy.

Affected Systems

Directly Affected

• XenServer / Citrix Hypervisor - all versions (shared XAPI codebase)
• XCP-ng - all versions (confirmed on 8.3.0)

Indirectly Affected

• All VMs on multipath-dependent storage - lose storage redundancy, become vulnerable to single-path failures
• iSCSI storage arrays - multipath failover protection removed
• FC/FCoE storage - path redundancy eliminated
• Monitoring systems - mpathcount monitoring disabled, path failures go undetected

Exploitation Scenarios

Chaining Analysis

• BOC-1 + HOC-3: vm-admin uses BOC-1 S3 (RBAC collapse) to self-grant pool-operator, then disables multipathing. The storage operates on a single path - one cable pull or switch failure causes a full outage.
• HOC-3 + HOC-1: Multipath disable (HOC-3) combined with multipathhandle injection (HOC-1) provides two independent paths to storage redundancy removal. HOC-1 can additionally achieve code execution if combined with a file write primitive.
• HOC-3 + SMC-1: Disabling multipath on a host that uses iSCSI storage removes the path redundancy that could mitigate SMC-1 storage protocol attacks.

Detection

• Monitor Host.other_config for changes to the multipathing key
• Alert on multipathing set to "false" on hosts with multipath-dependent SRs
• Monitor mpathcount process status - absence indicates monitoring disruption
• Check /var/run/nonpersistent/multipath_enabled on each host
• See rule H-03 in disclosure/vendor-detection-guidance.md

Remediation

Short-Term Mitigations

• Audit all Host.other_config records for unexpected multipathing and multipathhandle values
• Verify that multipath is enabled on all hosts with multipath-dependent storage
• Monitor multipath path counts for sudden drops to single-path

Long-Term Fix

Protect the key via map_keys_roles. Add multipathing and multipathhandle to Host.other_config map_keys_roles at _R_POOL_ADMIN in datamodel_host.ml.

Add operational guard. Prevent disabling multipathing when the host has active SRs that require multipath I/O. Require explicit confirmation or pool-admin role for the change.

Add monitoring alert. Generate a pool-wide alert when multipathing is disabled on any host.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

• Public release: 2026-04-24 08:00 CEST
• CERT/CC notified: 2026-04-23
• MITRE CVE reservation filed: 2026-04-09 (no response as of publication)
• EU CVE registers notified: 2026-04-18 (GCVE/CIRCL, ENISA, DIVD - no response)
• Vendor (Cloud Software Group / Citrix): not contacted pre-publication
• Downstream maintainer (Vates/XCP-ng): contacted 2026-04-23 with conditional patch offer

References

• XAPI source: SR.py:456-467 (multipathing read during init), SR.py:462 (string comparison), mpath_null.py (no-op module), xapi_host_helpers.ml:601-611 (event watcher sync), datamodel_host.ml:2929-2934 (field definition)
• Thematic advisory: disclosure/advisories/hoc-security-advisory.md (HOC-3)
• Investigation: research/investigations/host-other-config.md

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.