AMD Hardware Vulnerability Exposed by DRAM Address Scrambling Research
Researcher Christopher Domas releases tool demonstrating how manipulating memory controller registers can bypass hardware security fences on AMD processors.
Security researcher Christopher Domas has released a proof-of-concept tool that exploits the memory controller architecture of AMD processors, effectively bypassing hardware security mechanisms. The project, named skitter-creek-bath-salts, demonstrates how manipulating DRAM address translation registers can scramble physical address mappings, allowing access to protected memory regions that are typically invisible to the operating system and kernel.
The technique, described as "spaghettifying" memory, targets the deepest level of the memory hierarchy known as the MCT/DCT layer. Here, physical addresses from the data fabric are rewritten into raw DRAM coordinates before being issued to the memory modules. By altering these final-stage translations, the tool circumvents the memory fences built around the coherent view of physical addresses, which underpin security features such as AMD’s Secure Encrypted Virtualisation (SEV) and Intel’s Software Guard Extensions (SGX).
Developed and tested specifically on AMD Family 16h processors, the research utilises linear algebra to reconstruct scrambled address aliases. Domas employs a Z3 SMT solver to decipher the translation matrix by gathering alias pairs from the scrambled memory view. This allows the tool to map any protected physical address to an accessible alias, unlocking data such as PSP private memory, SMRAM, and C6 idle-state caches without triggering the platform’s security checks.
The exploit enables reading and writing to critical system components, including the fTPM’s RSA engine and SMI handler entry vectors. By rewiring the DRAM controller, the tool can access the fTPM’s cryptographic keys and microcode patch RAM stored during idle states. These regions are normally fenced off and considered inaccessible from user space or even ring-0, yet the scrambling technique renders these protections ineffective by altering the underlying address pipeline.
While the implementation focuses on AMD Family 16h CPUs, the final generation with datasheets documenting these specific translation registers, the underlying architectural principles appear broader. Domas notes that the transforms involved extend to ARM, RISC-V, and other architectures, suggesting that modern memory controllers across Intel, ARM, and RISC-V platforms utilise similar layers of abstraction. The research highlights a fundamental vulnerability in how hardware security relies on address translation integrity.
