Local information disclosure via alternate return prediction

Unprotected return prediction in some Intel Processors allows local users to disclose data through speculative execution. When the return stack buffer underflows, the processor selects a restricted alternate branch predictor whose entries can be influenced within the current prediction domain, transiently steering a RET instruction to a disclosure gadget. Low-privilege local code and high attack complexity are required, and the documented impact is data disclosure without modification or service interruption.