Unprivileged thread can read data from privileged thread memory from CPU cache memory.
vulners.com/securityvulns/securityvulns:doc:8618
vulners.com/securityvulns/securityvulns:doc:8624
vulners.com/securityvulns/securityvulns:doc:8692
vulners.com/securityvulns/securityvulns:doc:8782
vulners.com/securityvulns/securityvulns:doc:9031