[wohlergehen]

Section 6.4 of the Meltdown paper seems to indicate that the same flaw is present in AMD CPUs, but not easily exploitable.

Do you have a different source for that?

[contrarian_]

The toy example referenced in section 6.4 is actually closer to Spectre. It's missing the crucial distinction that the speculatively loaded address should belong to a page inaccessible from the current ring level.

To see why that toy example is insufficient, consider that you could simply execute the load directly without putting an exception in front of it and you would be able to read the value.