The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.
- https://www.exploit-db.com/exploits/46208/
- https://github.com/bcoles/kasld