tl;dr

• Double fetch race Condition in store_note function.
• overwrite size during race window to get buffer overflow.
• Do SROP for execve(“/bin/sh\x00”)