I seen these claims, but I've never seen a publicly available demonstration of these exploits.
Converting random bits into meaningful data would seem to be the sticky point.
Converting random bits into meaningful data would seem to be the sticky point.
The most impressive was a local exploit for spectre which on certain kernel versions could leak /etc/shadow, and a similar one for windows that sometimes could leak a ntlm hash for local admin user. Both were from a commercial pentesting software company.
There’s claims of more impressive ones in academia, but no fucker in academia is sharing their code as usual.