Researchers from Germany's Helmholtz Center for Information Security have identified a critical cache vulnerability, dubbed "LoongLeak," in processors manufactured by China's Loongson Technology. The flaw, which stems from the LoongArch instruction set architecture (ISA), allows attackers to extract sensitive data from the L1 data cache, even when operating from within unprivileged user space, containers, or virtual machines.
The researchers, Lorenz Hetterich, Tristan Hornetz, Fabian Thomas, and Michael Schwarz, detailed their findings in a paper and on a dedicated website, LoongLeakAttack.com. They discovered the vulnerability using a fuzzer and subsequently traced it to an instruction within the LoongArch ISA manual that leaves 32 bits of a memory register in an "uncertain" state. Their analysis confirmed that this "uncertain" data originates from the L1 data cache, which lacks proper isolation between applications.
This architectural leakage grants attackers precise control over cache set and line offset, enabling them to prime the CPU's internal state to target specific cache sets. The researchers demonstrated several impactful case studies, including the recovery of full-disk AES keys from the kernel, partial root password hashes from user-space, and the bypassing of traditional software defenses like ASLR and stack canaries, all within seconds. Significantly, LoongLeak can also cross virtual machine boundaries to leak host data.
Unlike many side-channel attacks, LoongLeak does not require high-resolution timers or traditional side-channel amplification. The researchers emphasize that software mitigations are not feasible for this vulnerability. Users with affected chips would either need to replace them or implement measures to prevent private data from entering or remaining in the L1 cache, potentially by disabling one thread per core, which effectively turns off hyperthreading.
Loongson has reportedly addressed the flaw in an update to its 3A6000 processor model. The mitigation involves evicting cache data, which the company claims results in a worst-case performance degradation of only 1.4 percent.
The potential impact of LoongLeak is primarily confined to China, as Loongson chips are not widely adopted outside the country. Loongson produces chips for various applications, including PCs, servers, and appliances like printers. The Chinese government actively promotes the use of Loongson chips as part of its strategy to reduce reliance on imported technology. While Lenovo manufactures laptops with Loongson chips for the Chinese market, other major PC manufacturers have not adopted them.
The researchers noted that there are currently no specific tools or methods available to detect if LoongLeak is being exploited, which could pose a challenge for government agencies and other entities within China that are mandated to procure local products and may be operating vulnerable devices.
