Kernel memory disclosure via poisoned return predictions

Speculative execution in affected AMD processors allows local users to read arbitrary kernel memory through poisoned return predictions. On affected microarchitectures, an indirect jump poisons the branch target buffer so a kernel return speculates to an attacker-selected disclosure gadget, exposing cache state. Exploitation requires unprivileged local code execution and a susceptible AMD processor; demonstrated Linux attacks recovered privileged kernel data, including password hashes.