how do Meltdown & Spectre exploit the memory hierarchy?

$-$Spatial locality: by measuring which user$-$space memory access takes less time, these attacks can read values in memory near a kernel$-$space memory address

$-$ Temporal locality: by measuring which user$-$space memory access takes less time, these attacks can determine the value at a kernel$-$space memory address

$-$ Cache coherency: by measuring the differences in the values between two caches, these attacks can determine which kernel$-$space addresses were updated