Attacking Branch Predictors to Bypass ASLR [pdf]
cs.binghamton.edu