reported<\/a> in May.<\/p>\nResearchers showed different exploits of Loongson 3A5000 and 3A6000 CPUs. On 3A5000, researchers ran the open-source video processing software FFmpeg and were able to leak special values called stack canaries that are added to programs during compilation to help detect buffer overflows before they can overwrite critical stack data.<\/p>\n
On the 3A6000 CPU, researchers obtained the entire random salt value used for root’s password before hashing and part of the resulting password hash from the \/etc\/shadow root entry.<\/p>\n
“The Loongson 3A6000 CPU supports simultaneous multi-threading, meaning a single physical CPU core operates as two logical CPU cores,” researchers said. “These logical CPU cores share a single L1 data cache, allowing LoongLeak to leak data from the sibling core.” So they also ran passwd -S on another hardware thread to make the system read the Linux shadow file that stores users\u2019 password hashes and load the secret data into the CPU’s vulnerable cache.<\/p>\n
The stolen hash is sufficient to mount a dictionary attack, and the overall exploit is similar to what attackers can do with a hardware vulnerability called Meltdown that allows programs to steal data currently being processed on the computer, researchers said.<\/p>\n
In another use case, researchers extracted AES keys from the kernel that are used for disk encryption.<\/p>\n
Virtual machines are also vulnerable as one attacker-controlled VM can leak data such as private certificates or SSH keys from other co-located VM. “This is especially threatening in a cloud scenario where an attacker could be co-located with VMs from other customers,” researchers said.<\/p>\n
“While we first discovered LoongLeak with a differential fuzzer, there is also a hint in the LoongArch manual,” researchers said. “The FLD.S instruction, which loads 32 bits from memory and stores it into a floating-point register, leaves the high 32 bits of the register ‘uncertain’.”<\/p>\n
Software updates or patches cannot fix this vulnerability because the bug lies in the hardware. Researchers suggest evicting the L1 data cache by filling it with non-sensitive data. Loongson has also fixed the flaw in their latest chip production.<\/p>\n","protected":false},"excerpt":{"rendered":"Researchers Leaked Root Password Data, Stack Canaries and AES Keys Tiffany Wang \u2022 August 13, 2026 \u00a0 \u00a0…\n","protected":false},"author":2,"featured_media":635733,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[74],"tags":[268666,18,268665,19,17,268664,268663,268661,268662,82],"class_list":["post-635732","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-chinese-processors","tag-eire","tag-hardware-security","tag-ie","tag-ireland","tag-l1-cache-leak","tag-loongarch","tag-loongleak","tag-loongson-cpu-vulnerability","tag-technology"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@ie\/117090406154561062","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/635732","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/comments?post=635732"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/635732\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media\/635733"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media?parent=635732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/categories?post=635732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/tags?post=635732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Chinese](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/08\/chinese-loongson-cpus-expose-sensitive-l1-cache-data-image_large-10-a-32551.jpg\")
<\/p>\n