Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of scanning through the page cache, finding /etc/shadow or equivalent, and cracking the passwords. For concreteness, say it's a Linux kernel running on x86-64, but I would be interested in methods that would work on other kernels/hardware as well. References to papers describing techniques or existing exploit code would be much appreciated.
There may well be many more.