Loading story…
Researchers from Germany’s Helmholtz Center for Information Security disclosed LoongLeak, a cache leakage vulnerability affecting Loongson processors built on the LoongArch ISA. The flaw is tied to an instruction documented as leaving 32 bits of a memory register in an “uncertain” state, which the researchers found can leak data from the shared L1 data cache across applications and the operating system. Their testing showed attackers could extract sensitive information including full-disk AES keys, partial root password hashes, and data useful for defeating ASLR and stack canaries within seconds.
The researchers said exploitation is possible from unprivileged user space, containers, and guest virtual machines, enabling leakage across VM boundaries into host data. Software-only mitigations were described as insufficient, though Loongson reportedly addressed the issue in an update to its 3A6000 processor. A cache-eviction mitigation was also noted, with an estimated performance impact of up to 1.4%.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Loongson reportedly fixed the LoongLeak flaw in an update to its 3A6000 processor. The reporting also notes software-only mitigations are insufficient, and cache-eviction mitigation can impose up to a 1.4 percent performance hit.
Researchers from Germany’s Helmholtz Center for Information Security disclosed LoongLeak, a cache leakage flaw affecting Loongson processors based on the LoongArch ISA. They reported that the issue can leak L1 cache data across applications, the operating system, containers, and guest VMs, enabling recovery of sensitive material and bypasses of ASLR and stack canaries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceloongleakattack.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026
Intel, Microsoft, VMware, Xen, and Linux maintainers published mitigation guidance for **Downfall** / **Gather Data Sampling (GDS)**, a transient execution side-channel vulnerability tracked as **`CVE-2022-40982`** that affects multiple Intel processor generations from **Skylake through Tiger Lake/Ice Lake-era parts**. Research by Google’s Daniel Moghimi showed the flaw can leak sensitive data across security boundaries—including processes, the kernel, virtual machines, sibling threads, and some trusted execution environments—by abusing speculative execution of **gather** instructions to expose stale vector register contents. Reported impacts include theft of passwords, encryption keys, SGX-protected data, and other memory-derived secrets, with shared and cloud environments highlighted as particularly exposed. Intel said mitigation relies primarily on updated **microcode** that blocks transient results of gather instructions from being observed speculatively, while Microsoft directed Windows customers to obtain Intel platform updates from OEMs and noted the protection is enabled by default. VMware said hypervisor patches are generally not required if underlying firmware is updated, while Xen issued advisory **XSA-435** and stable-tree fixes plus options such as restricting **AVX** for untrusted guests. Intel and downstream guidance warned that mitigation can carry noticeable performance costs—minimal for many workloads but up to **50%** for gather-heavy applications—and added that newer Intel families such as **Alder Lake, Raptor Lake, and Sapphire Rapids** include protections and are not considered affected.
Jun 29, 2026
Researchers from MIT CSAIL disclosed an **interrupt injection** attack that can bypass Linux’s `Safe RET` mitigation for Spectre-class attacks on **AMD Zen 1 through Zen 4** processors, potentially allowing information disclosure from kernel memory. AMD acknowledged the issue in its **Return Address Security Bulletin** and said the weakness stems from Linux’s implementation of the mitigation for **Speculative Return Stack Overflow (SRSO)** rather than the processor architecture alone. The flaw lets an attacker with code execution on a target system precisely time an interrupt to disrupt branch predictor sanitization and weaken the intended protection. Linux has already patched the issue in the latest kernel Git code by addressing the handling of interrupts around the `Safe RET` mitigation path. The researchers reported demonstrating arbitrary kernel memory leakage on **AMD Zen 2** systems running Linux with default Spectre v2 defenses, achieving **5.47 bytes per second** at **91.97% accuracy** and reading `/etc/shadow` in five of ten attempts. The work was reported by **Daniël Trujillo** of MIT CSAIL, presented at **Black Hat USA**, and accompanied by a proposed fix that adds a second predictor neutralization step on interrupt return; researchers also said related misprediction behavior was observed on some Intel systems, though AMD is the vendor that formally assigned and documented the vulnerability.
Aug 12, 2026