- Speculative/out-of-order execution in CPUs can leave traces in the cache, breaking the assumption of no side effects.
- Meltdown exploits the absence of memory permission checks during speculative execution, allowing kernel memory reads via cache timing.
- Spectre bypasses bounds checks by manipulating branch prediction, enabling access to arbitrary memory across processes or browser tabs.
- A more powerful Spectre variant uses branch history buffer collisions to induce speculative execution across security boundaries like VM hosts.
- Mitigations are challenging as speculative execution is deeply embedded in CPUs; software countermeasures are being developed.