Race condition in the prepare_binprm function in fs/exec.c in the Linux
kernel before 3.19.6 allows local users to gain privileges by executing a
setuid program at a time instant when a chown to root is in progress, and
the ownership is changed but the setuid bit is not yet stripped.

A race condition between chown() and execve() was discovered in the Linux
kernel. A local attacker could exploit this race by using chown on a
setuid-user-binary to gain administrative privileges.

 jdstrand> android kernels (flo, goldfish, grouper, maguro, mako and manta) are
  not supported on the Ubuntu Touch 14.10 and earlier preview kernels
 jdstrand> linux-lts-saucy no longer receives official support
 jdstrand> linux-lts-quantal no longer receives official support