Broken locking in TIOCSPGRP leads to corrupted refcount
A vulnerability in the TTY subsystem. Potentially exploitable — a strategy mentioned. By Jann Horn from Project Zero.
https://bugs.chromium.org/p/project-zero/issues/detail?id=2125
Post #43
2.25K