Spectre Attacks: Exploiting Speculative Execution

Spectre asks how code can read a secret even when a correct bounds check rejects the access. Read it to see how branch-predictor training opens a transient wrong path, how one secret-indexed cache line survives architectural rollback, and why process isolation, timer changes, compiler barriers, and processor controls each cover only part of the hardware-software contract.

Reading focus: Why speculative execution can perform a forbidden load without ever committing its register result. How a secret byte selects one probe-array cache line and later timing turns that physical trace back into data. Why Spectre mitigations target different ingredients of the attack and cannot be treated as one universal patch.

IEEE Symposium on Security and Privacy 2019. Paul Kocher et al.. 30 min read, medium difficulty.