Spectre
/ SPEK-ter /
Modern CPUs do not wait around. When they reach a branch — an 'if', a bounds check, a fork in the road — they guess which way it will go and speculatively run ahead on that guess, so they are already deep into useful work by the time the real answer arrives (see branch-prediction and speculative-execution). If the guess was wrong, they throw away the speculative results so the official program state looks as if nothing happened. Spectre, disclosed in 2018, is the discovery that 'as if nothing happened' is not quite true: the mis-speculated path can leave fingerprints in the cache, and an attacker can read those fingerprints.
Here is the trick in one breath. An attacker trains the branch predictor to expect a certain direction (for instance, by repeatedly making a bounds check pass), then feeds an out-of-bounds input. The CPU, trusting its training, speculatively executes past the check, reads memory it should not, and uses that secret value to index an array — pulling a secret-dependent cache line into the cache. Then the real bounds check resolves, the CPU realizes the access was illegal, and it discards the architectural effects. But the cache line stays warm. A Flush+Reload cache-timing measurement then reads the secret out of the cache (see cache-timing-attack). The official result was correct; the secret leaked through the cache footprint of work that was supposed to be erased.
Spectre matters, and is taught honestly, because it is not a fixable bug in one chip — it is a consequence of speculation itself, a performance feature present in virtually every fast processor for two decades. It lets a program leak data from within its own address space across a logical boundary (one sandbox tricking the CPU into reading another part of the same process), which broke the isolation that JavaScript sandboxes and many defenses relied on. Mitigations exist — fences that stop speculation at sensitive points, masking that clamps indices even on the wrong path, retraining-resistant predictors — but they are partial and cost performance, and new Spectre variants keep appearing. Spectre's lasting lesson is that the clean ISA contract hides microarchitectural state real attacks can pry open, and that performance and security are in genuine tension.
Code does: if (i < array_len) y = probe[ array[i] x 256 ]. The attacker first calls it with valid i many times to train the predictor that the check passes, then calls it with i out of bounds. The CPU speculatively assumes the check passes, reads the secret byte array[i], and uses it to touch probe[secret x 256] — caching one specific line. The bounds check then fails and the access is squashed, but the warmed line in probe reveals secret to a following cache-timing probe.
A trained branch predictor speculates past a bounds check; the squashed read still leaves a secret-shaped cache footprint.
Spectre is not a software bug you can simply patch in the victim and it is not unique to one vendor — it is intrinsic to speculation, which is why it is mitigated, not cured, and why new variants keep surfacing.