The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel memory by reading a tty data structure.
https://github.com/torvalds/linux/commit/dd42bf1197144ede075a9d4793123f7689e164bc
http://www.securityfocus.com/bid/94138