Two methods for exploiting speculative control flow hijacks [pdf]
usenix.org