Comment by thijson

It was possible to poke two byte memory locations with the value 255, run a new shell, and you would be root. I figured that out by comparing memory dumps as different users, figuring out which locations corresponded to user and group number.