Researchers from Germany’s CISPA Helmholtz Center for Information Security have identified a hardware-level vulnerability in Loongson processors (which use the LoongArch instruction set). The flaw, dubbed LoongLeak, allows an attacker without administrative privileges to read sensitive data directly from the chip’s L1 cache. This includes disk encryption keys, password hashes, and other sensitive kernel memory from other applications or the operating system. The issue stems from a specific instruction (FLD.S) that leaves certain register bits in an undefined state — under particular conditions, these bits pull data directly from the L1 cache, which is not properly isolated between processes. Attackers can even tailor the attack to target specific data. Crucially, this is a hardware defect: no software patch can fix it. Mitigations include clearing the L1 cache when transitioning from kernel to user mode (with minimal performance impact) or disabling simultaneous multithreading (SMT) on affected models, though the latter reduces computational throughput. Loongson has addressed the issue in a new hardware revision for the 3A6000 model, but all previously manufactured 3A5000 chips and earlier 3A6000 units remain permanently vulnerable.
About the Author
