The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
openbsd openbsd 2.3