TECH Signal 358
Loongson's LoongLeak cache flaw exposes kernel keys and crosses VM boundary
↗
A fuzzer-discovered flaw in Loongson's LoongArch lets attackers leak data from the L1 cache across applications, the OS, and VMs.
Loongson chips are used in Chinese government and consumer hardware, and the flaw cannot be mitigated in software; users must replace chips or disable hyperthreading. The attack works from unprivileged user space, containers, and VMs, and there are no detection tools.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The leak originates from the L1 data cache, which is not isolated between applications.
The attack can recover full-disk AES keys from the kernel, root password hashes, and bypass ASLR and stack canaries.
Loongson fixed the flaw in an update to its 3A6000 processor, and the cache-eviction mitigation slows performance by 1.4% in the worst case.
THE CLUSTER