Iret #GP may suffer from a privilege escalation vulnerability due to a pre-commit handling failure.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/81457/iret-escalate.txt
Source: https://packetstormsecurity.com/files/81457/Iret-GP-Pre-Commit-Privilege-Escalation.html