How do Meltdown & Spectre exploit the memory hierarchy?

Cache coherency: by measuring the differences in the values between two caches, these attacks can determine which kernel$-$space addresses were updated

Spatial locality: by measuring which user$-$space memory access takes less time, these attacks can read values in memory near a kernel$-$space memory address

Temporal locality: by measuring which user$-$space memory access takes less time, these attacks can determine the value at a kernel$-$space memory address