[bennofs]

You can exploit existing binaries such as ping that have special capabilities or are setuid to get privilege escalation.

A better link would have been https://www.qualys.com/2017/09/26/cve-2017-1000253/cve-2017-... which also explains an actual exploit.

[willvarfar]

Fair enough.

(But e.g. ping doesn't >128MB .data+.bss? ;) )

[bennofs]

The article also explains this. It seems to be possible to get a much smaller distance if you eat up a lot of stack space using large execve arguments for example (this might be wrong, I haven't 100% understood all details yet). But the article has a POC for ping.