Race you to the kernel!
Ian Beer of Google Project Zero described a race condition in the OS X and iOS kernel's setuid root binary loading: the kernel swaps the new virtual memory map pointer into the old task object before invalidating the old task port, leaving a window to...