Researchers from Germany’s Helmholtz Center for Information Security have found that processors made by China’s Loongson leak data through their caches, enabling attacks from unprivileged user space, containers, and even guest virtual machines.
Loongson builds its own LoongArch instruction set architecture, which blends approaches from MIPS and RISC-V. The researchers discovered the issue with a fuzzer, then noticed that the LoongArch ISA manual describes an instruction that leaves 32 bits of a memory register in an “uncertain” state.
Under certain circumstances, that uncertain data originates from the L1 data cache. Since the cache is not isolated between applications, the attack, dubbed LoongLeak, can leak data from other applications and the operating system. An attacker can even prime the CPU’s internal state to target the leakage to a specific cache set.
In case studies, authors Lorenz Hetterich, Tristan Hornetz, Fabian Thomas, and Michael Schwarz recovered full-disk AES keys from the kernel, partial root password hashes from user space, and bypassed defenses such as ASLR and stack canaries, all within seconds. The flaw crosses the virtual machine boundary, leaking host data from inside a VM.
The work echoes the Spectre-era discovery that microarchitectural side channels can undermine supposed isolation boundaries. Where Spectre exploited speculative execution, LoongLeak abuses architectural uncertainty in register state to reach cache contents that should be private to other processes.
Loongson chips are used widely in Chinese government and enterprise systems, and the researchers note the attack works against the current generation of hardware. No patch has been announced, so affected operators should monitor for firmware updates and treat the architecture’s isolation guarantees as unproven for sensitive workloads until a fix ships.
