The Attacker Goal: Become uid 0

• Each task in Linux has a struct cred holding its uid, gid, and capabilities. These fields decide what the process is allowed to do.
• If an attacker can overwrite their own credentials so that uid == 0, the process becomes root — no password, no exploit of setuid binaries needed.
• Two broad strategies once you have a bug:
• Data-only: corrupt cred (or a similar object) directly. Often dodges control-flow defenses.
• Control-flow: hijack a kernel function pointer and run a payload that elevates privileges.
• Then return cleanly to user space and spawn a root shell.