LoongLeak Vulnerability Plagues Loongson Processors
Cybersecurity experts recently uncovered a severe hardware flaw within Chinese Loongson processors. They dubbed this critical issue the LoongLeak vulnerability. Alarmingly, this flaw permits unauthorized users to read sensitive data directly from the L1 cache without requiring administrative privileges. Consequently, the exposed information includes the operating system and other running applications. The potential targets for exploitation encompass encryption keys, password hashes, and crucial data required to circumvent memory protection protocols.
Discovery and Affected Architectures
Researchers hailing from the German CISPA Helmholtz Center for Information Security discovered this defect utilizing a differential fuzzer. This sophisticated tool meticulously compared instruction execution on a physical processor against the QEMU emulator. The vulnerability specifically afflicts the Loongson 3A5000 and 3A6000 models. Both of these processors rely upon the proprietary LoongArch architecture.
The Mechanics of the Hardware Defect
Instruction FLD.S and Uninitialized States
The root cause of this massive data leak traces back to the FLD.S instruction. This specific instruction loads 32 bits from memory into a 64-bit register for floating-point operations. However, it critically leaves the upper 32 bits in an undefined, uninitialized state. The situation worsens when utilizing the 256-bit LASX extension. In this scenario, the undefined region expands drastically to 224 bits, or 28 bytes.
Extracting Real Data from the L1 Cache
The researchers conclusively determined that, under specific conditions, actual data from the L1 cache bleeds into these remaining bits. The cache inherently stores sensitive information from various applications and the operating system itself. Therefore, a malicious actor can covertly read data belonging to completely unrelated processes. By preemptively manipulating the processor’s internal state, an attacker can precisely target the leak toward a desired set and cache line offset.
High-Speed Data Exfiltration
The LoongLeak vulnerability transfers up to 28 bytes per single operation. Astonishingly, this achieves an exfiltration speed exceeding 300 MB/s. Furthermore, this mechanism does not require complex high-precision timers or side-channel attacks. The data flows directly into the processor’s vector registers. Importantly, this flaw stems from a fundamental architectural error. It does not belong to the Spectre or Meltdown class of transient execution attacks.
Experimental Exploitation and Impact
Bypassing Security Mechanisms
During their rigorous experiments, the research authors successfully extracted complete AES full-disk encryption keys directly from the kernel. They also obtained portions of the highly sensitive root account password hash. Furthermore, they effortlessly bypassed ASLR and stack canary memory protection mechanisms. Incredibly, these devastating operations concluded within mere seconds.
Virtualization and Privilege Escalation
The attack successfully executes from standard user space without requiring any elevated privileges. It also remains highly effective when launched from within containers and virtual machines. Malicious code running inside a virtual machine possesses the frightening capability to breach the virtualization boundary. Subsequently, it can read sensitive data from the underlying host system.
Mitigation Strategies and Hardware Revisions
Software Workarounds and Performance Costs
Unfortunately, administrators cannot eradicate a hardware defect via a simple software patch. However, they can significantly mitigate the risk by forcefully flushing the L1 cache during transitions from the kernel to user code. This cache flush reduces overall performance by a maximum of 1.4%. In most benchmark tests, the slowdown remains negligible, rarely exceeding 0.1%. Protecting the Loongson 3A6000 requires a more drastic measure. Administrators must additionally disable one logical thread on every single core, which substantially diminishes overall computing power.
Vendor Response and Global Threat Context
Loongson officially acknowledged the severe problem and successfully reproduced the data leak. The company has already rectified the hardware defect in a newly released hardware revision of the 3A6000. These specific processors see predominant usage within China, particularly across government and administrative institutions. Therefore, the global scale of this threat remains somewhat limited. Currently, no specialized tools exist to reliably detect the active exploitation of the LoongLeak vulnerability.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
