The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
CVSS Metrics
