[beebmam]

It is very clear, you just didn't read it.

>We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever!

>This works because the register file is shared by everything on the same physical core. In fact, two hyperthreads even share the same physical register file.

>It turns out that mispredicting on purpose is difficult to optimize! It took a bit of work, but I found a variant that can leak about 30 kb per core, per second.

>This is fast enough to monitor encryption keys and passwords as users login!

[hinkley]

Literally the intro says it might contain the root password.

TLDR: The vector registers this bug affects are used for string functions like strcmp, so anything could get loaded into them, including passwords.