Here a more clear explanation step-by-step of such attack:

https://bugzilla.redhat.com/show_bug.cgi?id=2032401