DRAM Controller Register Manipulation Breaks CPU Memory Isolation

7 relevance

Deep hardware security research breaking CPU memory isolation, highly novel and technically impressive but not directly actionable.

Security infoq.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a solutions architect focused on cloud infrastructure and confidential computing, this vulnerability undermines the foundational assumption of physical memory isolation in bare-metal and multi-tenant environments, requiring immediate re-evaluation of hardware security boundaries in platform engineering.

Key Takeaways

Audit your bare-metal and confidential computing deployments for AMD Family 14h-16h processors and ensure memory controller translation registers are locked during boot to prevent downstream address swizzling attacks.

DRAM Controller Register Manipulation Breaks CPU Memory Isolation

Summary

Christopher Domas's open-source project skitter-creek-bath-salts exploits DRAM controller register manipulation to break CPU memory isolation, targeting AMD Family 14h, 15h, and 16h processors. By flipping bits like BankSwizzleMode, the tool dynamically alters physical-to-DRAM address mappings below the hypervisor, SMM, and PSP security fences, allowing unprivileged software to access protected enclaves like SMM RAM and microcode patch buffers. The exploit uses a Linux kernel module with cache flushing and Galois Field arithmetic to derive address mappings, exposing a critical architectural blind spot where upstream security checks cannot guarantee integrity against downstream memory controller swizzling.

Author

Olimpiu Pop