Privilege escalation via getcwd boundary writes

Buffer overflow in GNU C Library before 2.31 allows local users to corrupt memory in setuid programs through getcwd(). When a one-byte buffer and overlong current directory force the generic fallback, it prepends a slash before the buffer and moves two bytes into it, writing beyond both boundaries. Triggering the flaw requires bind-mounting / over that directory in an unprivileged mount namespace and executing a setuid program that calls getcwd() with size 1, enabling arbitrary code execution with elevated privileges.