Loongson Processors Vulnerable to LoongLeak Cache Side-Channel Attacks
Researchers have discovered LoongLeak, a critical cache side-channel vulnerability in Chinese Loongson processors, enabling unprivileged attackers to steal sensitive data.
Researchers from Germany’s Helmholtz Center for Information Security have identified a significant cache side-channel vulnerability, dubbed LoongLeak, affecting processors manufactured by China's Loongson.
Loongson processors utilize the LoongArch instruction set architecture (ISA), a hybrid design incorporating elements from MIPS and RISC-V. The vulnerability stems from a specific instruction mentioned in the LoongArch ISA manual that leaves 32 bits of a memory register in an "uncertain" state. The researchers' analysis revealed that this "uncertain" data originates from the L1 data cache under specific circumstances.
Crucially, the L1 data cache is not isolated between different applications or processes. This means an unprivileged attacker can exploit LoongLeak to leak sensitive data from other applications running on the system, as well as from the operating system kernel itself. The researchers further demonstrated that an attacker can manipulate the CPU's internal state to precisely target the leakage to a specific cache set.
The implications of LoongLeak are severe. Case studies presented by the researchers include the recovery of full-disk AES encryption keys from the kernel, partial root password hashes from user-space applications, and the bypassing of common software defenses such as Address Space Layout Randomization (ASLR) and stack canaries. These sensitive data leaks can reportedly be achieved within seconds.
Adding to the severity, LoongLeak can be exploited from various unprivileged environments, including user space, containers, and virtual machines. The vulnerability even allows attackers to leak data from the host system while operating within a virtual machine, crossing the isolation boundary.
The researchers highlight that the leakage is architectural, meaning it does not require high-resolution timers or traditional side-channel amplification techniques. Furthermore, it grants the attacker precise control over the cache set and line offset, making targeted data extraction more efficient.
Unfortunately, software-based mitigations for LoongLeak are not feasible. Affected users must either replace their hardware or implement drastic measures, such as disabling hyperthreading (effectively running one thread per core) to prevent sensitive data from entering or remaining in the L1 cache. While Loongson has reportedly patched the flaw in its 3A6000 processor and cache eviction mitigations only incur a minor performance penalty, the limited adoption of Loongson chips outside China may restrict the immediate blast radius.
The potential for exploitation within China, where Loongson processors are promoted to reduce reliance on imported technology, remains a concern. The researchers noted that there are currently no specific tools or methods available to detect if LoongLeak is being actively exploited, making it difficult for affected entities to identify attacks.