How do Meltdown & Spectre exploit the memory hierarchy?

A Spatial locality: by measuring which user$-$space memory access takes less time, these attacks can read values in memory near a kernel$-$space memory address

B Temporal locality: by measuring which user$-$space memory access takes less time, these attacks can determine the value at a kernel$-$space memory address

C Cache coherency: by measuring the differences in the values between two caches, these attacks can determine which kernel$-$space addresses were updated