A novel attack strategy has emerged, targeting the very heart of modern computer security by manipulating a computer’s memory controller. This technique can circumvent robust hardware security measures within current processors, including System Management Mode, Platform Security Processor, and CPU microcode protections.
The research, made public on GitHub under the project name skitter-creek-bath-salts, was spearheaded by security expert Christopher Domas. It highlights a vulnerability within the DRAM controller’s address-translation logic, a crucial layer often overlooked by existing defenses.
Understanding the DRAM Controller’s Role
Every physical address a CPU generates is processed by the memory controller, which translates it into specific memory locations within the DIMM’s architecture. The security features such as SEV, SGX, TDX, TrustZone, and firmware memory carveouts depend on these addresses remaining constant once they are out of the CPU core. Domas’s findings disrupt this assumption with a single instruction.
By altering certain configuration bits in the memory controller, attackers can manipulate how physical addresses correlate with actual DRAM cells. This process, described as ‘spaghettifying’ memory, enables different addresses to point to the same previously restricted memory cell, compromising access-control mechanisms.
Implications of the DRAM Scrambling Attack
This vulnerability isn’t due to a single flaw that can be easily fixed. It stems from the linear operations within the memory controller’s address transformation over GF(2), which can be reconstructed using linear algebra and tools like the SMT solver Z3, even if manufacturers keep the remapping details confidential.
Domas demonstrated the attack on AMD Family 16h processors, extracting sensitive data like the fTPM’s RSA signing routine from supposedly isolated Platform Security Processor memory. The attack also revealed secure data from the System Management Mode and exposed the CPU’s microcode patches during idle states.
Future Outlook and Industry Response
This research, targeting an older AMD platform, has broader implications as similar architectural patterns are prevalent across various modern memory controllers, including those by AMD, Intel, ARM, and RISC-V. Domas plans to present these findings at Black Hat 2026, urging the industry to respond to this security threat that traditional CPU models cannot address.
The ongoing developments in this area will be closely watched by researchers and chipmakers alike, as they seek strategies to mitigate this significant vulnerability class and reinforce CPU security models against such sophisticated attacks.
