Security researcher Christopher Domas discovers a vulnerability in AMD processors that allows unprivileged software to access isolated platform memory regions

Security researcher Christopher Domas has unveiled an open-source hardware security project that dismantles traditional CPU privilege boundaries by targeting the lowest layer of the physical memory hierarchy.

Security researcher Christopher Domas has unveiled an open-source hardware security project that dismantles traditional CPU privilege boundaries by targeting the lowest layer of the physical memory hierarchy. The project, called skitter-creek-bath-salts, manipulates memory controller translation registers to dynamically alter physical-to-DRAM address mappings at the hardware logic level. This enables unprivileged software to access isolated platform memory regions without triggering upstream architectural memory fences or fault exceptions. The exploit utilizes a multi-stage software pipeline, including a custom Linux kernel module and automated probing scripts, to catalogue address bit collisions and derive the exact bitwise mapping. Once the map is resolved, the exploit executes targeted read/write bursts against previously impenetrable enclaves, including System Management Mode (SMM) RAM, PSP firmware tables, CC6 processor sleep save areas, and microcode patch buffers. The vulnerability highlights the vital distinction between CPU and platform privilege, and experts emphasize that hardware teams must ensure memory controller translation registers are strictly locked during boot to secure future systems. The discovery has sparked significant interest in the hardware security and reverse-engineering communities, with discussions centered on the architectural implications of the discovery and the practical limitations of the exploit. The exploit requires Ring 0 privileges and targets registers primarily accessible on older AMD Family 15h and 16h processors. Experts note that the vulnerability poses risks to bare-metal cloud and confidential computing, and that upstream security checks cannot guarantee integrity if downstream memory controller logic permits dynamic address swizzling.