Local data disclosure via speculative load disordering

Speculative load disordering in all Intel Processor families allows local users to infer program data through a covert channel. Concurrent shared-memory accesses can transiently expose a fresh value under a stale tag before a pipeline flush, causing dependent operations to treat an integer as a pointer. Exploitation requires low-privilege local access, cross-logical-processor communication that relies on strong memory ordering, and a suitable disclosure gadget; Intel reports no known practical attack.