So, during the execution of new binary, the opened file descriptor to the executable is put into the file table of the current (the caller of execve()) process. This can be exploited creating a file sharing parent/child pair by means of the clone() syscall and reading the file descriptor from one of them.
>>> Подробности
