cpr (libcpr) in SGI IRIX prior to 6.5.25 allows local users to gain privileges by loading a user provided library while restarting the checkpointed process.