Reading the bug report it sounds like it has more to do with the Copy-on-Write behavior. If I've understood correctly, I think it works something like this: A

Reading the bug report it sounds like it has more to do with the Copy-on-Write behavior. If I've understood correctly, I think it works something like this: A privileged process needs to use some shared-object/library, and the OS loads that file into memory for it. An unprivileged process creates an exact duplicate of the library file and asks the OS to load that into memory. This triggers the copy-on-write system to realize that these are identical, and creates a link between them so that both processes are using the same chunk of memory. The privileged process then doesn't actually use the library for a while, so the OS pages it out of memory, while keeping that copy-on-write link around. This is where the sneaky/buggy part lies, in that it's possible for the unprivileged process to modify its version of the library file without the copy-on-write system being informed of the write (and thus separating the two diverging copies). This is apparently related to some details of how mounting filesystem images works. The next time the privileged process tries to use the library, the OS sees that it has already been paged out, but hey here's this copy-on-write link pointing at this "identical" version over here, and loads the poisoned version into the privileged process.