Researchers expose cache leakage vulnerability in Chinese Loongson CPUs

A team from Germany's Helmholtz Center for Information Security discovered that Loongson processors suffer from a cache leak that can be exploited to extract data, even from inside virtual machines.

Researchers at Germany’s Helmholtz Center for Information Security identified a cache-side-channel flaw in Loongson CPUs that stems from a LoongArch instruction leaving 32 bits of a register in an "uncertain" condition. Their tests revealed that the L1 data cache is not isolated between applications, enabling the LoongLeak technique to siphon data from other programs, the operating system, and even the host machine when run inside a virtual machine.

Case studies demonstrated rapid extraction of full-disk AES keys, portions of user-space password hashes, and circumvention of defenses such as ASLR and stack canaries. The attack works from unprivileged user space, containers, or VMs, and cannot be mitigated by software alone; mitigation requires disabling one thread per core, effectively turning off hyper-threading. Loongson has issued a microcode update for its 3A6000 model, and the performance hit from cache eviction is reported as only 1.4 percent. While the chips are primarily used within China, the flaw raises concerns for government and domestic users relying on locally sourced hardware.