Security researcher Christopher Domas has disclosed a memory-controller attack that can expose highly protected DRAM regions on certain older AMD processors.
The research, released with the open-source skitter-creek-bath-salts project, targets AMD Family 15h and 16h systems, in which configuration registers that control memory address translation may not be lockable.
The technique is not a conventional software permission bypass and is distinct from Rowhammer. Rather than inducing bit flips in DRAM, it changes the final mapping between a physical address and the bank, rank, row, and column coordinates selected in memory.
This creates a temporary alternative view of DRAM in which an address accessible to privileged software can resolve to the same memory cell as a protected region.
New DRAM Scrambling Attack
The attack matters because platform security controls generally operate above the memory controller. Page tables, IOMMUs, firmware carveouts, chipset locks, and processor protections determine whether a physical address is allowed.
Domas’s work operates underneath those controls, modifying the translation applied after the platform has accepted the physical address.
Security checks can therefore see an apparently legitimate request while the controller directs it to an unintended location in DRAM. The project calls this process “spaghettifying” memory.
By changing the controller’s DRAM swizzle and address-translation behavior, the researcher creates aliases between ordinary memory and protected areas. The normal configuration is then restored after the access, reducing disruption to the running platform.
The research models the address transformations as linear operations over GF(2), allowing mappings between coherent and scrambled address views to be derived from observed alias pairs.
This enables an attacker to calculate an accessible alias for a target protected location rather than blindly scrambling system memory. Domas demonstrated the technique on a Family 16h test machine against memory normally inaccessible even to kernel-level code.
Reported examples include Platform Security Processor memory containing fTPM code, System Management Mode memory holding an SMI handler, and C6 power-state save areas that preserve processor context in DRAM.
The research also identifies a DRAM copy of microcode patch data used when a core returns from the C6 idle state.
That finding raises concerns about the integrity of the data that supports processor recovery, because the demonstrated aliasing technique can read and overwrite memory presumed to be protected by platform hardware.
AMD has acknowledged the underlying issue in security bulletin AMD-SB-7068. The vendor says certain Family 15h and 16h processors may contain memory-controller configuration registers responsible for system-memory address translation that cannot be locked.
AMD also states that the affected processor families have reached the end of security support and will not receive security updates. Practical exploitation has an important limitation: an attacker must already possess root or administrator privileges.
That prerequisite substantially limits its value as an initial-access vector, but it makes the flaw relevant to post-compromise operations, malicious-administrator scenarios, firmware research, and environments where a local privileged compromise must not expose hardware-protected secrets.
The disclosure should not be interpreted as proof that current Zen-based AMD CPUs, Intel chips, or ARM and RISC-V systems share this specific weakness.
Similar address-translation stages exist across modern memory controllers, but each implementation requires separate validation.
Organizations using legacy AMD Family 15h or 16h hardware should identify affected devices, tightly restrict privileged access, isolate unsupported systems, and plan replacement where hardware-backed memory isolation is a security requirement.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
