German researchers have discovered that processors from China’s Loongson Corporation have a cache leak vulnerability that potential attackers could exploit to search for specific information.
Image source: loongleakattack.com
Loongson has developed its own instruction set LoongArch, which combines MIPS and RISC-V methods. German scientists used fuzzy programming to discover a bug and named it dragon leak. They noticed that the LoongArch manual mentioned an instruction that left 32 bits of the memory register in an “undefined” state. Subsequent analysis showed that in some cases, this “undefined” data came from the L1 cache – which is not isolated between applications, meaning that this mechanism can be used to intercept data from various programs and operating systems. In addition, a potential attacker can configure the internal state of the processor to leak the information he desires.
To confirm their hypothesis, the researchers intercepted AES encryption keys, partial hashes of the root password from user space, and managed to bypass protections such as ASLR and stack checks.
LoongLeak attacks can be deployed directly from virtual machines to intercept data from the host server. The vulnerability is related to an architectural feature of the processor and cannot be completely closed using software – the chip should not, in principle, allow confidential information to enter the first level cache. You can deactivate the second thread on the same core, but that essentially means giving up Hyper-Threading technology. Loongson has reduced the risk of being attacked in the software update of the 3A6000 model – the cache clearing mechanism only reduces chip performance by 1.4% in the worst case scenario. Since Loongson chips are rarely used outside of China, the actual threat from this vulnerability is small.
If you find an error, select it with your mouse and press CTRL+ENTER.
