{"id":567429,"date":"2026-08-13T04:30:12","date_gmt":"2026-08-13T04:30:12","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/567429\/"},"modified":"2026-08-13T04:30:12","modified_gmt":"2026-08-13T04:30:12","slug":"chinese-loongson-processors-have-leaky-caches-researchers-find","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/567429\/","title":{"rendered":"Chinese Loongson processors have leaky caches, researchers find"},"content":{"rendered":"

security<\/p>\n

Attackers could extract data, even working from inside a guest VM<\/p>\n

Researchers from Germany\u2019s Helmholtz Center for Information Security have found processors made by China\u2019s Loongson have leaky caches that attackers could use to seek specific data.<\/p>\n

Loongson has developed its own LoongArch instruction set architecture (ISA) that blends approaches used by MIPS and RISC-V.<\/p>\n

On a site called LoongLeakAttack.com<\/a>, the researchers explain that they found the leaky cache using a fuzzer, then noticed that the LoongArch ISA manual mentions an instruction that leaves 32 bits of a memory register in an \u201cuncertain\u201d state.<\/p>\n

\u201cOur analysis reveals that under certain circumstances, the \u2018uncertain\u2019 data originates from the L1 data cache,\u201d the four researchers wrote. \u201cSince this cache is not isolated between applications, LoongLeak can leak data from other applications and the operating system. Even worse, an attacker can prime the CPU\u2019s internal state to target the leakage to a specific cache set.\u201d<\/p>\n

In a paper<\/a> [PDF] explaining their research, authors Lorenz Hetterich, Tristan Hornetz, Fabian Thomas, and Michael Schwarz share case studies that \u201cinclude recovering full-disk AES keys from the kernel, partial root password hashes from user-space, and bypassing traditional software defenses such as ASLR and stack canaries, all within seconds.\u201d<\/p>\n

In case that\u2019s not scaring you enough, they also point out \u201cLoongLeak can be exploited from unprivileged user space, containers, or virtual machines.\u201d The flaw even means \u201cLoongLeak can cross the virtual machine boundary and leak host data from inside a VM.\u201d<\/p>\n

\u201cAs the leakage is architectural, it requires neither high-resolution timers nor traditional sidechannel amplification, and it grants the attacker precise control over cache set and line offset,\u201d they add.<\/p>\n

And the cherry on top is that software mitigations aren\u2019t possible. Users with chips that possess the flaw either need to replace them or make sure they don\u2019t allow any private data to enter or remain in the L1 cache. Making that happen can require turning off one thread per core, effectively disabling hyperthreading.<\/p>\n

The news isn\u2019t all bad, because Loongson fixed the flaw in an update to its model 3A6000 processor, and the mitigation of evicting cache data slows performance by just 1.4 percent in the worst case.<\/p>\n

The blast radius of this flaw is also likely to be limited, because Loongson chips are hardly used outside China.<\/p>\n

The company offers chips for PCs, servers, and appliances such as printers. China\u2019s government promotes use of Loongson chips as part of its plan to reduce dependence on imported tech.<\/p>\n

Lenovo makes laptops that use Loongson chips<\/a>\u00a0but only sells them in China. The Register has discussed the company\u2019s chips with other major PC-makers, who told us they would adopt Loongson product if users want them, or if doing so becomes necessary to participate in the Chinese hardware market. But we\u2019ve not seen a non-Chinese company adopt the processors.<\/p>\n

China\u2019s government, however, may be nervous about this research as it has instructed public sector buyers to buy local products. Perhaps some government agencies are running vulnerable devices? If that\u2019s the case, Beijing has its work cut out spotting any attacks, because the researchers could find \u201cno specific tools or methods to detect if LoongLeak is being exploited.\u201d \u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"security Attackers could extract data, even working from inside a guest VM Researchers from Germany\u2019s Helmholtz Center for…\n","protected":false},"author":2,"featured_media":567430,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[111,139,69,145],"class_list":["post-567429","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-new-zealand","tag-newzealand","tag-nz","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/567429","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=567429"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/567429\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/567430"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=567429"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=567429"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=567429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}