ASA-2019-00109 – QubesOS: Insecure default DisposableVM networking configuration

In Qubes OS, one can attempt to limit the network access of a qube by either completely disconnecting it from any NetVM or by setting its firewall rules to disallow access. A malicious qube can circumvent these limits by launching a DisposableVM [1], which, in the default configuration, would have unrestricted network access. Moreover, even when a non-default DisposableVM is configured to have no network access (or limited access), other DisposableVMs started from _that_ DisposableVM can have full network access (unless explicitly configured otherwise). While limiting network access in this manner should not be considered to be an effective leak-prevention mechanism [1], we still consider this type of potentially ineffective network isolation to be a problem.