A cache bug allows you to overwrite effectively any area in memory, including in this case kernel memory. Since you can overwrite kernel memory all you need to

A cache bug allows you to overwrite effectively any area in memory, including in this case kernel memory. Since you can overwrite kernel memory all you need to do is change the uid of your process to 0, and then the OS will happily do whatever you want. Alternatively just overwrite the address of a popular system call to a function that you prefer. With a little metasploit code this thing should be completely cross platform.