Also, `/tmp` is often mounted noexec. At the time the exploit lands, is the current directory writable?