This used to be half of the two-step about every security hole: (1) this hole can only get you root running as an already authenticated user, or (2) this hole o

This used to be half of the two-step about every security hole: (1) this hole can only get you root running as an already authenticated user, or (2) this hole only gets an attacker restricted user-level permissions. Thankfully we don't see this so much lately. This post illustrates the large amount of extra work still needed to counter the depressingly common "this only corrupts unused memory, so it can't be exploited".