AI Weekly Malaysia

Researchers from Belgian and German academic institutions demonstrated at the 35th Usenix Security Symposium that commercial out-of-order RISC-V processors—specifically SiFive P550 and T-Head Xuantie C910/C920—are vulnerable to all major Spectre variants (PHT, BTB, RSB, STL), achieving up to 100% recall and 97%+ precision in proof-of-concept attacks. In-order RISC-V processors (SiFive U74, Xuantie C906, C908) appear unaffected.

Why: If you're evaluating RISC-V silicon for embedded or edge deployments, prefer in-order cores (U74, C906, C908) over out-of-order ones (P550, C910/C920) if Spectre-class side-channel leakage is a threat model concern. The T-Head Xuantie C910/C920 chips are Alibaba's designs and are among the more accessible commercial RISC-V parts in Asia, so builders sourcing from regional distributors should factor in that mitigations are not yet mature compared to the x86/ARM ecosystem.

Researchers from Germany's Helmholtz Center for Information Security found that Chinese Loongson processors (pre-3A6000) have leaky L1 data caches exploitable via an architectural flaw in the LoongArch ISA, allowing unprivileged attackers to recover kernel AES keys, root password hashes, and bypass ASLR within seconds—even from inside a VM. Software mitigations are not possible; affected users must either replace the chip or evict private data from L1 cache (costing ~1.4% performance), which can require disabling hyperthreading.

Why: Almost certainly irrelevant to Malaysian builders unless you are running workloads on Loongson hardware or evaluating it for procurement. The practical takeaway is narrow: if you are sourcing Loongson chips for cost or sovereignty reasons, only buy the 3A6000 or later, and treat earlier models as unfixable for multi-tenant or VM workloads.