Researchers from the Helmholtz Center for Information Security discovered "LoongLeak," an architectural vulnerability in the LoongArch ISA affecting Loongson processors, specifically the 3A6000 series. The flaw resides in the L1 data cache, where a fuzzer-discovered instruction allows unprivileged users, containers, or virtual machines to leak 32 bits of cached data directly into a memory register. This enables the bypass of critical security primitives including ASLR and stack canaries, facilitating cross-boundary data exfiltration. Demonstrated exploits include full-disk AES key recovery from the kernel and Guest-to-Host VM leakage. Remediation varies from a firmware update for the 3A6000 to total hardware replacement or disabling hyperthreading for older iterations.

• Vulnerability Overview: Architectural Flaw

  • LoongLeak is a direct architectural leak rather than a traditional timing or power-based side-channel attack.
  • Affects the L1 data cache within the LoongArch instruction set, a domestic Chinese ISA blending MIPS and RISC-V elements.
  • Allows unprivileged actors to extract sensitive data across isolation boundaries, including user-to-kernel and VM-to-Host.

• Technical Mechanics: L1 Cache Leakage

  • The vulnerability is triggered by a specific instruction that leaves a memory register in an uncertain state.
  • This state allows for the direct leakage of 32 bits of data from the L1 cache.
  • The leak effectively neutralizes Address Space Layout Randomization (ASLR) and stack canaries by revealing precise memory locations.

• Exploitation Status: Demonstrated Impact

  • Kernel Exploitation: Researchers successfully recovered full-disk AES keys from the kernel.
  • User-Space Exploitation: Demonstrated partial recovery of root password hashes.
  • Virtualization Breach: Proven ability to leak data from a Guest VM to the Host OS, breaking hardware-level isolation.

• Remediation and Detection

  • 3A6000 Series: A fix is available resulting in a maximum performance degradation of 1.4%.
  • Legacy Hardware: Requires physical hardware replacement or the disabling of one thread per core (effectively disabling hyperthreading).
  • Detectability: There are currently no known tools or behavioral indicators to detect active exploitation of LoongLeak.

• Strategic Implications: Domestic Supply Chain Risk

  • Poses a significant security risk to Chinese government agencies mandated to adopt domestic silicon.
  • Underscores the fragility of domestic ISA implementations when compared to mature, audited architectures.
  • Creates a critical failure point for organizations attempting to reduce reliance on foreign technology via Loongson adoption.