>>>> Then there are local exploits.  Ted Ts'o for example keeps fuzzying
>>>> ext4 for years yet exploitable bugs still pop up frequently -- usually
>>>> just DoS but arbitrary code execution isn't unheard of.    

>>> I've read a lot of e2fsprogs CVEs, and cannot recall any ever having
>>> been _proved exploitable_ to allow arbitrary code execution.  In a
>>> number of cases, there have been bugs, generally buffer overflows, that
>>> in theory could _possibly_ lead to arbitrary code execution that in
>>> theory might exploit privileged code such as e2fsprogs mount code, thus
>>> in theory possibly supporting privilege escalation.