The exploit already succeeded at that point, creating the setuid /tmp/rootsh is ...

		cperciva 17 days ago \| parent \| context \| favorite \| on: Local privilege escalation via execve() The exploit already succeeded at that point, creating the setuid /tmp/rootsh is just a way of making it permanent.