This is a true tour-de-force in computer security.

The way they exploit the MMU page table walk is just exquisite.