If the attacker just provides a file system that contains setuid shells or unsecured device files, that's not really a bug and not remotely exploitable. But it's still a vulnerability.
Hopefully filesystems mounted by normal users will have nosuid,nodev enforced (whoever is responsible for this these days, policykit??). Please tell me I'm correct...
