Full paper is out: https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs...

Anyone with good programming skill can make the exploit in matter of hours => it surely is somewhere on black market.