Full write up in the link! From unprivileged user to root.
No sysctl or seccomp workaround.
Disclaimer - I work at Stealthium, alongside the team that found this + another LPE we're discussing today. Happy to answer questions on exposure.
Click to Open Code Editor