Boffins exploit Intel CPU weakness to run rings around code defenses

Neo code!

So you can guess the contents of the Branch Target Buffer from user-level software using timing? That's pretty meta. We might find that "destroy on read" Quantum Mechanics is Nature's surefire way to prevent any breakouts from Her Virtual Machine.

The hack takes advantage of the CPU's branch target buffer, a mechanism present in many microprocessor architectures including Intel Haswell CPUs.

In most CPUs since the 90's I would guess.

The paper has some recommendations though:

A hardware solution that would fundamentally mitigate the BTB-based attacks is to change the BTB addressing mechanism in a way that prevents exploitable collisions in the BTB. The attack against KASLR can be mitigated by using full virtual address for accessing the BTB, thus eliminating collisions between the user code and the kernel code. This would require adding extra bits in the BTB, as the tag size will increase significantly (by 17 bits compared to Haswell implementation for 48-bit virtual addresses). Alternatively, the BTB can use different indexing functions for user and kernel-level code. For example, a secret value can be added to the existing BTB hash function when the CPU is executing in the kernel mode. To prevent the user process from discovering this value and reverse-engineering the hash function, this value can be randomized during each system’s boot.

Non sequitur?

...miscreants must be able to at least start running their malicious code within an application or operating system on the target machine – this isn't a remote attack, it's a local attack.

Um, what?

dependent on a remote code execution flaw != "a local attack"

It's hardly as if remote code execution flaws are unheard of, now, is it?!!!!!!!!!oneoneone