AMD Memory Controller PoC Bypasses Hardware Isolation on Family 16h Processors

Security researcher Christopher Domas has published a proof-of-concept project called skitter-creek-bath-salts that demonstrates how to bypass hardware memory isolation on AMD Family 16h processors.

The technique works by manipulating settings in the DRAM controller. While software and hardware mechanisms normally enforce access control based on physical addresses, the memory controller performs the final translation into specific DRAM coordinates: channel, rank, bank, row, and column. Domas showed that changing a single register can reconfigure this translation after higher-level protections have already been applied, creating an alternative address that points to the same DRAM cells.

To keep the system stable, the PoC disables interrupts, prepares the cache and translation tables, temporarily alters the addressing scheme, performs the read or write operation, and then restores the original configuration. Address discovery relies on linear algebra and the Z3 SMT solver to map the relationship between normal and modified memory layouts and calculate aliases for protected regions.

The researcher demonstrated potential access to the AMD Platform Security Processor, including fTPM data, protected System Management Mode areas, processor C6 states, and microcode storage. The microcode scenario could allow not only extraction of a patch copy but also its modification before kernel state is restored.

The PoC has been tested exclusively on AMD Family 16h processors. No information is currently available about similar vulnerabilities affecting newer AMD generations, Intel, ARM, or RISC-V platforms.