Alright, I'll repeat it one more time. The (attacker's) program is already running inside a chroot -- presumably because they got code execution from some chro

Alright, I'll repeat it one more time. The (attacker's) program is already running inside a chroot -- presumably because they got code execution from some chroot-ed process (after all, chroot is a layer of security right?). The attacker opens a file handle to ".". They then chroot() to a subdirectory. Then they fchdir() relative to the file handle all the way to the host's root. Then they chroot() to the host root. They have now broken out of the original chroot(). I really don't think I can break it down any further.