Reading privileged memory with a side-channel

Part two of Trail of Bits' Meltdown and Spectre explainer details Spectre V1 bounds-check bypass and V2 branch target injection, noting nearly every processor from the last 25 years is affected.

Part one of Trail of Bits' accessible Meltdown and Spectre overview explains the computer architecture basics—caching, speculative execution, branch prediction—behind the two CPU design flaws.

Google Bug Hunters explore CPU side-channel vulnerabilities that affect nearly all modern processors, demonstrating practical real-world exploitation and why such flaws are hard to mitigate.

A detailed overview of L1TF, a CPU vulnerability affecting some Intel CPUs (Skylake and older), including how it can be exploited and possible mitigation strategies.

From REcon 2015: a hardware side channel against co-located cloud VMs exploiting CPU pipeline behavior instead of cache tiers, enabling crypto key theft, process monitoring, and covert messaging.

CacheOut (CVE-2020-0549) is a new Intel speculative execution flaw letting attackers select and leak data from L1 cache across security boundaries, including VMs and SGX enclaves.