DRAM Controller Register Manipulation Breaks CPU Memory Isolation
Security researcher Christopher Domas developed skitter-creek-bath-salts, an open-source hardware security tool that disrupts CPU privilege boundaries by manipulating memory controller translation registers. This allows unprivileged software to access protected memory regions, revealing a vulnerability in modern processor architectures that could affect cloud and confidential computing security.…
Security researcher Christopher Domas has unveiled a new open-source project called skitter-creek-bath-salts, which exploits a gap in CPU memory isolation by manipulating DRAM controller registers. By altering memory controller translation registers, Domas' tool allows unprivileged software to access isolated platform memory regions without triggering standard memory fences or fault exceptions.
This vulnerability exposes a critical architectural blind spot, as upstream security checks cannot guarantee integrity if downstream memory controller logic permits dynamic address swizzling. The exploit utilizes a multi-stage software pipeline, including a custom Linux kernel module that offline non-boot CPU cores, flushes system caches, and disables interrupts.
This vulnerability poses risks to bare-metal cloud and confidential computing, highlighting the need for hardware teams to ensure memory controller translation registers are strictly locked during boot.
Brief written by urgent.news from InfoQ's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
