It is described on http://shinnai.altervista.org/exploits/SH-008-20101026.html
Thanks to geal for helping finding the problem
(cherry picked from commit b531955c)
Signed-off-by: Rafaël Carré <rafael.carre@gmail.com>