MOKSHA-2026-0051: Config Drive Misidentification via VDI.other_config config-drive

Summary

A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can mark any VDI as a cloud-init config drive by setting config-drive=true in VDI.other_config. The config-drive key is defined in xapi_globs.ml:289 as a sync key and consumed by import.ml:1180 during migration and restore operations. When a non-config VDI is falsely flagged, guest cloud-init agents misinterpret its contents as trusted hypervisor-provided metadata, potentially initializing the guest with attacker-controlled configuration. The VDI.other_config field has no per-key RBAC protection for the config-drive key.

Vulnerability Description

VDI.other_config is a Map(String, String) field writable by vm-admin. The config-drive key controls whether a VDI is treated as a cloud-init metadata source during migration and import operations.

The code path:

1. vm-admin sets config-drive=true on a non-config VDI: VDI.add_to_other_config(vdi, "config-drive", "true")
2. The key is defined in xapi_globs.ml:289 as part of vdi_other_config_sync_keys
3. During migration or import, import.ml:1180 synchronizes the config-drive flag to the destination
4. Guest cloud-init reads the flagged VDI as a metadata source
5. The guest initializes with whatever data is on the VDI, treating it as trusted configuration

No validation occurs on the config-drive value. The flag is a simple presence check - any non-empty value is treated as true.

Root Causes

1. Missing RBAC protection. VDI.other_config has map_keys_roles entries only for folder and XenCenter.CustomFields.*. The config-drive key is writable by vm-admin without restriction.

2. No VDI content validation. The config-drive flag is a simple metadata tag. No check verifies that the VDI actually contains valid cloud-init metadata in the expected format (ISO 9660, VFAT, or similar).

3. Trusted metadata channel abuse. Guest cloud-init agents treat hypervisor-provided config drives as fully trusted. The hypervisor provides no mechanism for the guest to verify the provenance of the config drive flag.

4. set_other_config RBAC bypass. The set_other_config method replaces the entire map atomically and bypasses map_keys_roles per-key checks entirely.

Affected Systems

Directly Affected

• XenServer / Citrix Hypervisor - all versions (shared XAPI codebase)
• XCP-ng - all versions (confirmed on 8.3.0)

Indirectly Affected

• Cloud-init consumers - guest OSes using cloud-init for first-boot configuration
• Orchestration platforms - tools that rely on config-drive metadata for VM provisioning (CloudStack, OpenStack)
• Migration targets - the false flag propagates to destination pools during cross-pool migration

Exploitation Scenarios

Chaining Analysis

• BOC-1 + DOC-7: With root access via BOC-1 S3, an attacker can bulk-set config-drive=true on data VDIs across the pool, causing widespread guest misconfiguration on next migration or restore.
• DOC-7 + DOC-2: Config drive misidentification (DOC-7) combined with storage migration redirection (DOC-2) enables an attacker to both redirect migration targets and inject false config drive metadata simultaneously.

Detection

• Monitor VDI.other_config for unexpected config-drive=true entries on non-config VDIs
• Verify that VDIs flagged as config drives contain valid cloud-init metadata
• Alert on config-drive flag changes outside of normal VM provisioning workflows
• See rule D-07 in disclosure/vendor-detection-guidance.md

Remediation

Short-Term Mitigations

• Audit all VDI.other_config records for unexpected config-drive flags
• Restrict vm-admin delegated access to trusted administrators only
• Validate config drive contents during migration/import

Long-Term Fix

Add map_keys_roles protection. Restrict config-drive to _R_POOL_ADMIN in the VDI field definition in datamodel.ml.

Validate config drive content. When config-drive=true is set, verify that the VDI contains valid cloud-init metadata format before accepting the flag.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

• Public release: 2026-04-24 08:00 CEST
• CERT/CC notified: 2026-04-23
• MITRE CVE reservation filed: 2026-04-09 (no response as of publication)
• EU CVE registers notified: 2026-04-18 (GCVE/CIRCL, ENISA, DIVD - no response)
• Vendor (Cloud Software Group / Citrix): not contacted pre-publication
• Downstream maintainer (Vates/XCP-ng): contacted 2026-04-23 with conditional patch offer

References

• XAPI source: xapi_globs.ml:289 (vdi_other_config_sync_keys definition), import.ml:1180 (config-drive sync during import), datamodel.ml:6310-6315 (VDI.other_config field definition)
• Thematic advisory: disclosure/advisories/doc-security-advisory.md (DOC-7)
• Investigation: research/investigations/vdi-other-config.md

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.