So, Intel prefetches restricted data on a request by an unprivileged user, "conceals" the unauthorized but nevertheless prefetched data by nulling it out, but t

So, Intel prefetches restricted data on a request by an unprivileged user, "conceals" the unauthorized but nevertheless prefetched data by nulling it out, but the unprivileged user can infer sensitive information about what's "behind the curtain" by timing the proceeding instructions?