Branch Privilege Injection: Exploiting branch predictor race conditions

https://comsec.ethz.ch/research/microarch/branch-privilege-injection/