How can one gain additional privileges from being able to read kernel memory?

Question

Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of scanning through the page cache, finding /etc/shadow or equivalent, and cracking the passwords. For concreteness, say it's a Linux kernel running on x86-64, but I would be interested in methods that would work on other kernels/hardware as well. References to papers describing techniques or existing exploit code would be much appreciated.

Answer 1

1. You can do keylogging and learn people's passwords, SSH passphrases, etc.

2. You may be able to access filesystem buffers or process memory and learn SSH private keys, SSL private keys, etc.

3. You can access the internal pool for /dev/random and /dev/urandom, which may allow you to break crypto used by programs on the system.

4. You can access any crypto keys stored and used internally by the kernel.

5. You can defeat ASLR, which might make exploiting other vulnerabilities easier.

There may well be many more.