MOKSHA-2026-0076: Network Offload Disablement via PIF.other_config ethtool Keys

Advisory IDMOKSHA-2026-0076
Semantic IDPOC-4
Published2026-04-24
CVSS 3.14.9 Medium
CVSS 3.1 VectorAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 4.05.1 Medium
CVSS 4.0 VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
XAPI ObjectPIF
XAPI Fieldother_config:ethtool-*
Entry Rolepool-operator
ResearcherJakob Wolffhechel, Moksha

Affected Products

VendorProductVersions
Citrix / Cloud Software GroupXenServer / Citrix Hypervisorall versions (shared XAPI codebase)
VatesXCP-ng8.3.0

Summary

A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC hardware offload features on any physical network interface by writing ethtool-gro=off, ethtool-tso=off, ethtool-gso=off, ethtool-lro=off, or other ethtool-* keys to PIF.other_config. These keys are consumed by nm.ml:45-110 (determine_ethtool_settings) and passed to xcp-networkd for application via ethtool -K. Disabling offloads forces the host CPU to perform network segmentation and reassembly in software, causing performance degradation that affects all VMs and management traffic on the affected PIF. The ethtool-gro key has an additional impact: it overrides the PIF.properties:gro first-class field through a backward compatibility path documented in pif-properties.md:35. The PIF.other_config field has zero map_keys_roles entries.

Vulnerability Description

PIF.other_config is a Map(String, String) field defined at datamodel.ml:2784-2788 with no ~writer_roles override and no ~map_keys_roles. It inherits _R_POOL_OP from the PIF class default.

The ethtool settings extraction at nm.ml:45-110:

determine_ethtool_settings:
  reads ethtool-speed, ethtool-duplex, ethtool-autoneg, ethtool-advertise
  reads ethtool-rx, ethtool-tx, ethtool-sg, ethtool-tso, ethtool-ufo,
        ethtool-gso, ethtool-gro, ethtool-lro

The extracted settings are passed to xcp-networkd via bridge/interface configuration. xcp-networkd applies them using ethtool -K <interface> <feature> <on|off> through execve (no shell injection possible).

PIF.other_config has the highest merge precedence in the other_config merge chain at nm.ml:112-120. PIF values override both Network.other_config and Pool.other_config. This means a PIF-level ethtool setting cannot be overridden by pool-level or network-level configuration.

The performance impact of disabling offloads:

Root Causes

  1. Missing RBAC protection. PIF.other_config has zero map_keys_roles entries. All ethtool-* keys are writable by any pool-operator.

  2. No impact assessment at write time. XAPI does not evaluate whether disabling offloads on a management or storage PIF would degrade critical infrastructure performance.

  3. Backward compatibility override. The ethtool-gro key in other_config overrides the PIF.properties:gro first-class field, bypassing the RBAC and validation of the dedicated property.

  4. set_other_config RBAC bypass. The set_other_config method replaces the entire map atomically and bypasses map_keys_roles per-key checks.

Affected Systems

Directly Affected

Indirectly Affected

Exploitation Scenarios

Scenario Impact Pre-conditions Status
Management PIF performance degradation Host CPU saturation from software segmentation on management traffic pool-operator, disable TSO/GRO on management PIF Source-traced
Storage PIF throughput reduction iSCSI/NFS throughput drops due to software packet processing pool-operator, disable offloads on storage PIF Source-traced
GRO backward compat bypass Disable GRO via other_config, overriding PIF.properties:gro pool-operator Source-traced
BOC-1 chain vm-admin disables offloads across all PIFs via RBAC collapse vm-admin, BOC-1 Source-traced

Chaining Analysis

Detection

Remediation

Short-Term Mitigations

Long-Term Fix

Add map_keys_roles protection. Restrict ethtool-* keys to _R_POOL_ADMIN in datamodel.ml. NIC offload configuration is a host infrastructure operation.

Remove backward compatibility override. Deprecate the ethtool-gro other_config key in favor of the PIF.properties:gro first-class field with proper RBAC.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

References

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.

Jakob Wolffhechel · Moksha · Copenhagen
jakob@wolffhechel.dk · +45 3170 7337
Published 2026-04-24 08:00 CEST · cna.moksha.dk · shittrix.moksha.dk