Practical Timing Side Channel Attacks Against Kernel Space ASLR (2013) [pdf]

and one related article, TSX improves timing attacks against KASLR

http://labs.bromium.com/2014/10/27/tsx-improves-timing-attac...