A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the SR scanning interval by writing an arbitrary float value to Host.other_config:auto-scan-interval. The value is read at xapi_sr.ml:166-168 with float_of_string and no range validation. Setting an extremely small value (e.g., 0.001) causes continuous SR scanning, exhausting CPU and I/O resources. Setting an extremely large value (e.g., 999999999) effectively disables SR scanning, preventing XAPI from detecting storage state changes such as new VDIs, deleted snapshots, or capacity changes. The Host.other_config field has no map_keys_roles entries for infrastructure keys.
Host.other_config is a Map(String, String) field defined at datamodel_host.ml:2929-2934. The field inherits _R_POOL_OP as the minimum write role from the Host class default at datamodel_host.ml:2759. The auto-scan-interval key name is defined at xapi_globs.ml:221.
The scanning thread reads the interval value:
xapi_sr.ml:166-168:
let interval =
try float_of_string (List.assoc "auto-scan-interval"
(Db.Host.get_other_config ~__context ~self:host))
with _ -> 30.0
The float_of_string call is the only parsing step. If the string is not a valid float, the exception is caught and the default (30.0 seconds) is used. But any valid float is accepted without bounds checking:
0.001 - scans every millisecond, causing CPU/IO saturation0.0 - infinite loop with no delay (degenerate case)999999999.0 - scan interval of approximately 31 yearsMissing range validation. The float_of_string parse accepts any valid float. No minimum or maximum bounds are enforced.
Missing RBAC protection. Host.other_config has map_keys_roles entries only for UI keys (folder, XenCenter.CustomFields.*). The auto-scan-interval key is writable by any pool-operator.
No write-time validation. XAPI stores the value without checking whether it falls within an operationally safe range.
set_other_config RBAC bypass. The set_other_config method replaces the entire map atomically and bypasses map_keys_roles per-key checks.
| Scenario | Impact | Pre-conditions | Status |
|---|---|---|---|
| CPU/IO exhaustion | Continuous SR scanning saturates host CPU and storage I/O | pool-operator, set interval to 0.001 | Source-traced |
| Scan suppression | XAPI does not detect storage changes for extended period | pool-operator, set interval to 999999999 | Source-traced |
| Stale state exploitation | Attacker suppresses scanning, makes storage changes undetected | pool-operator, combined with storage manipulation | Modeled |
| BOC-1 chain | vm-admin manipulates scan interval across all hosts via RBAC collapse | vm-admin, BOC-1 | Source-traced |
Host.other_config for changes to the auto-scan-interval keydisclosure/vendor-detection-guidance.mdHost.other_config entries for unexpected auto-scan-interval valuesAdd range validation. Enforce a minimum (5.0 seconds) and maximum (3600.0 seconds) range for the auto-scan-interval value at write time.
Add map_keys_roles protection. Restrict auto-scan-interval to _R_POOL_ADMIN in datamodel_host.ml.
Upstream patches exist. They are held privately pending coordinated disclosure.
Disclosure:
datamodel_host.ml:2929-2934 (field definition), xapi_sr.ml:166-168 (float_of_string with no bounds), xapi_globs.ml:221 (key name definition)disclosure/advisories/hoc-security-advisory.md (HOC-4)research/investigations/host-other-config.mdDiscovered and reported by Jakob Wolffhechel, Moksha.