Re: Physical access vulnerabilities and auto-mounting

[Solar Designer <solar () openwall com>]

On Wed, Feb 23, 2011 at 12:46:47AM -0500, Nelson Elhage wrote:
> I don't have any definite opinions here about where to draw which
> lines, but I want to point out that in addition to physical attack
> vectors, virtualization tools are also potentially affected by these
> kinds of bugs. If you try to mount an untrusted VM's virtual disk
> image from somewhere, you're also vulnerable to that VM triggering
> bugs in the filesystem or other layers.

Excellent point.

Arguably, that would indicate improper design of the virtualization tool
or an inappropriate action by a sysadmin, though.  Here's an example:

http://www.linode.com/backups/

"The backup system must be able to mount your disk images on the host."

I wonder if they realize the risk they're taking...

Alexander