sofialund
Member
OP
homelab heatstroke
- Joined:
- Jul 2024
- Posts:
- 140
- From:
- Buenos Aires, Argentina
¡Polite complaint: my dedicated server shares a NIC with another tenant!
I rent the server dedicated in Contabo, the plan red of promotion. Two weeks ago I configure the bridge for VMs and ¡I see traffic ARP that not is mine! MAC addresses strange, IPs of the subnet other. I think "the server red" is compromised but no... I dump with tcpdump and I see frames of another tenant complete. The NIC same, the virtual function of SR-IOV misconfigured. I contact the support, they escalate to engineering. The fix they deploy silent, no changelog. Now they offer me credit of six months and NDA for the find. I sign because the money is money but ¡the transparency zero! The server red now is the server secure, I suppose. Anyone more with experience of disclosure responsible to providers small?
hot air, steady hand, magic smoke
GeorgeNmp
Member
AS64512
- Joined:
- May 2024
- Posts:
- 218
- From:
- Ashburn, US
SR-IOV misconfiguration exposing VFs across tenants is a failure of both PCI Passthrough isolation and the PF driver's VEB or legacy switchdev mode configuration. The PF should enforce VLAN or MAC-based filtering per VF; without this, you're effectively on a shared L2 segment with no security boundary.
Your responsible disclosure path was correct. The NDA is standard—providers fear RPKI-style reputation cascades if this hits NANOG or bgp.he.net incident threads. The credit is adequate for a non-transit customer; I've seen Leaseweb offer twelve months for comparable PCIe-level escapes.
For verification: check
ip link show vf 0
and confirm your VF MAC differs from the neighbor's. If the PF MAC anti-spoof is disabled, that's the root cause. Contabo should publish a post-mortem; silent fixes erode trust in IRR-adjacent processes.
iBGP, eBGP, don't care, just peer
svendeal
Member
Deal Sniper
- Joined:
- Jul 2024
- Posts:
- 301
- From:
- Miami, US
$12/MO DEDICATED ARE YOU KIDDING no wait this is Contabo not the deal. BUT SIX MONTHS CREDIT?? SNAPPED IT UP energy right there. OP basically got PAID to find their bug. I've been tracking Contabo pricing since 2023, this is the first time I've seen credit that fat for a non-outage. SR-IOV leaks are RARE to catch from tenant side, nice find!
world record: 4min Arch install
GeorgeNmp
Member
AS64512
- Joined:
- May 2024
- Posts:
- 218
- From:
- Ashburn, US
Two weeks ago I configure the bridge for VMs and ¡I see traffic ARP that not is mine!
Typical. The PF driver version is material to the CVE timeline; Intel i40e had SR-IOV bypass bugs through 5.15, Mellanox mlx4 through 4.19. Without disclosure you can't assess recurrence risk. The NDA gags the finder but not the vulnerability.
For your bridge: verify with
ethtool -i eth0 | grep driver
and compare against your local kernel. If they're behind, demand maintenance window notice.
iBGP, eBGP, don't care, just peer
svendeal
Member
Deal Sniper
- Joined:
- Jul 2024
- Posts:
- 301
- From:
- Miami, US
They fix one PF, redeploy the golden image to ten other racks
This is why I track pricing not security lmao. But fr, Contabo's Nuremberg and Munich are their oldest DCs, if the bug was in a base image from 2021 it could be everywhere. OP got lucky catching it with a bridge config, most people run default and never know.
Still. $12/mo plan, six months = $72 credit. That's almost a free year if you downgrade after. SNAPPED IT UP energy remains valid.
world record: 4min Arch install
