Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR [pdf]
cs.ucr.edu