LoongLeak

LoongLeak<br>LoongLeak is a vulnerability affecting the Loongson 3A5000 and 3A6000 CPUs.<br>LoongLeak allows unprivileged attackers to leak data from the L1 data cache, including data from other processes or the operating system.<br>READ<br>CITE

@inproceedings{Hetterich2026LoongLeak,<br>author = {Lorenz Hetterich and Tristan Hornetz and Lorenz Hetterich and Fabian Thomas and Michael Schwarz},<br>booktitle = {USENIX},<br>title = {{LoongLeak: Architectural Cross-Privilege-Boundary Data Leakage on LoongArch CPUs}},<br>year = {2026}<br>Copy

Data

Loongson & LoongArch<br>Loongson is a CPU manufacturer that produces high-performance CPUs primarily targeting the Chinese domestic market, including government and administrative sectors.<br>These CPUs use a custom instruction set called LoongArch™.<br>The latest high-performance Loongson CPUs use the 64-bit variant of LoongArch named LA64.

Caches

Like other modern processors, Loongson processors rely on CPU caches.<br>CPU caches are small but fast memory units that keep a subset of data close to the CPU for faster access.<br>The CPU decides what data is stored in the cache, usually recently accessed data and data following predictable access patterns.

CPU caches do not distinguish between applications.<br>Data from multiple applications and the operating system can be stored in a cache at the same time.

CPU caches store fixed-size chunks of data (usually 64 bytes) called &ldquo;cache lines&rdquo;.<br>Most CPU caches are set-associative.<br>This means data is stored in a fixed-size table where the row (&ldquo;cache set&rdquo;) is decided by parts of the address and all columns (&ldquo;cache ways&rdquo;) of a single row must be checked.<br>To determine if an entry matches, the remaining address bits are stored alongside the data.

The Loongson 3A5000 and 3A6000 CPUs feature one 64KB L1 data cache (256 sets, 4 ways) and one 64KB L1 instruction cache per core, a larger but slower L2 unified cache (used for data and code) per core and an L3 unified cache that is shared by all cores.<br>Core 0ExecutionUnitsL1I64 KBL1D64 KBL2 Unified256 KBCore 1L2 Unified256 KBL1I64 KBL1D64 KBExecutionUnitsL3 UnifiedMain Memory (DRAM)

LoongArch Vector Extensions<br>CPUs use fixed-size data containers called &ldquo;registers&rdquo; for computations.<br>By default, LA64 supports 32 registers (f0-f31) for floating-point operations which are all 64 bits in size.<br>With the LSX vector extension, these registers are extended to 128 bits (vr0-vr31) and with the LASX vector extension to 256 bits (xr0-xr31).<br>LSX and LASX extend the base instruction set, meaning instructions that just operate on the lower 64 bits of the register are still supported.<br>Since 32-bit floating-point calculations are also commonly done in software, there are even instructions just operating on the lower 32 bits of the register.

LoongLeak<br>While we first discovered LoongLeak with a differential fuzzer, there is also a hint in the LoongArch manual.<br>According to the LoongArch manual, the FLD.S instruction, which loads 32 bits from memory and stores it into a floating-point register, leaves the high 32 bits of the register &ldquo;uncertain&rdquo;.<br>With LASX, the floating-point registers are extended to 256 bits, leading to 224 bits (28 bytes) of &ldquo;uncertain&rdquo; data.

Our analysis reveals that under certain circumstances, the &ldquo;uncertain&rdquo; data originates from the L1 data cache.<br>Since this cache is not isolated between applications, LoongLeak can leak data from other applications and the operating system.<br>Even worse, an attacker can prime the CPU&rsquo;s internal state to target the leakage to a specific cache set.

Demo<br>We show what LoongLeak can do with two proof-of-concept exploits.<br>In the first exploit, we use LoongLeak to leak the stack canary of ffmpeg on a Loongson 3A5000 CPU while it is encoding a video.<br>Stack canaries are used as a mitigation for stack-based buffer overflow exploits.<br>For successful exploitation, an attacker must first leak the canary.<br>We modified ffmpeg to print the canary on startup for verification.

A video demonstrating how LoongLeak can be used to leak the stack canary on affected systems.<br>The Loongson 3A6000 CPU supports simultaneous multi-threading, meaning a single physical CPU core operates as two logical CPU cores.<br>These logical CPU cores share a single L1 data cache, allowing LoongLeak to leak data from the sibling core.<br>While we are unable to accurately target the leakage when a sibling thread is active, the high throughput of LoongLeak allows leaking useful data.<br>We demonstrate this by leaking the first 32 bytes of the /etc/shadow entry of root containing the full salt and 9 bytes of the password hash , which is sufficient to mount a dictionary attack.<br>We run the attack on a Loongson 3A6000 CPU and execute passwd -S on the sibling thread to get the shadow file into the L1 data cache.

A video demonstrating how LoongLeak can be used to leak a partial root password hash from a sibling thread.<br>Overall, the...