I encourage you to research the rabbit hole that is speculative executive and 'spectre' attacks.

"Speculative Execution" is gonna be my boat name.

I'll tell people it's a punny triple entendre, leading people to believe I am a wall street hacking guru hit-man.

I know what speculative execution is and have some understanding of spectre already. What I don't get is what it means to exploit a speculative race condition.

So the thing with speculative attacks is that you can use an invariant that is broken speculatively to leak things. In this case they use a speculative race condition to gain speculative code execution, much like you can use a normal race condition to gain real code execution. Arbitrary speculative code execution can be used to leak data which can be picked up via side channels.

This is described pretty well in the paper, but briefly: the "race condition" which they exploit happens because the CPU speculatively (and incorrectly) thinks it acquired a lock. Multiple threads being in a critical section can be exploitable and lead to arbitrary read/write and malicious code execution (one case demonstrated in the paper is some random NFC function). The researchers abuse the fact that the critical section can be entered speculatively to gain speculative malicious code execution, which they then use to construct a gadget which leaks arbitrary kernel memory into side channels.

Thank you!