

Basically it’s two vulns chained; first one gives a remote user privileges that a physically present user would get, in order to do things like put a thumbdrive in and have it mount. Then that udisks privilege can be subverted to escalate that level to root. So as long as you can start a remote session, you can pull root and it doesn’t even look that hard.
Same with Piped. Pinchflat downloads it so even if it were throttled when it fetches, it will play at local speeds