Post

"Interesting use cases show up throughout the tree, [...] In case of an attack gaining code execution, the process's fd table contains less capable dirfd either because of the process locking directory descriptors it uses itself, or libc locking descriptors used very temporary."