Security researcher Christopher Domas has published skitter-creek-bath-salts, an open-source hardware security project that claims to break traditional CPU memory isolation by manipulating memory controller translation registers. The work focuses on the lowest layer of the physical memory hierarchy, where address mappings can be altered in ways that let ordinary software reach protected regions without triggering the usual architectural faults.
How DRAM controller register manipulation bypasses memory boundaries
According to the report, the technique changes how the memory controller translates physical addresses into DRAM bank, row, and column locations. That matters because common defenses such as hypervisor Extended Page Tables, System Management Mode TSEG limits, and Platform Security Processor carveouts are enforced above the controller, at the core and system fabric interconnect layer.
Domas’ finding is that these checks validate the untranslated physical address, while the controller can still remap where that access lands. In practical terms, a request that appears to target a normal address can silently end up inside a protected enclave if the controller’s swizzling logic has been changed.
What the tool does inside the system
The published workflow uses a multi-stage software pipeline to keep the host stable while the memory map is being studied and rewired. The report says a custom Linux kernel module offlines non-boot CPU cores, flushes system caches, pre-warms translation lookaside buffers, and disables interrupts before probing begins.
From there, automated scripts use a coupon-collector heuristic together with targeted userspace reads to identify address bit collisions. The accompanying tooling then models the physical address permutation using Galois Field arithmetic and an SMT solver to determine the exact bitwise mapping.
Registers and settings named in the report
- BankSwizzleMode — a configuration bit cited as changing how the controller calculates DRAM coordinates.
- Memory controller translation registers — the low-level settings the project manipulates.
- Physical-to-DRAM address mappings — the translation layer the tool aims to alter dynamically.
Protected areas the project says it can reach
Once the mapping is understood, the exploit reportedly performs targeted read and write bursts against regions that are normally inaccessible from regular software. The report specifically names System Management Mode RAM, PSP firmware tables, CC6 processor sleep save areas, and microcode patch buffers.
That is why the work has drawn attention in security circles. If the claims hold up broadly, the issue is not simply a flawed page table or a misconfigured hypervisor rule, but a deeper architectural blind spot in the way CPU privilege and platform memory translation interact.
Why this is different from a standard privilege escalation
The report stresses an important distinction between CPU privilege and platform privilege. Ring 0 access is still required, but on the processors discussed, that level of access is treated as trusted enough to manipulate the controller settings in question. The result is that kernel-level control can become a stepping stone to areas that were assumed to be protected below the OS.
This is particularly relevant for bare-metal cloud and confidential computing deployments, where operators rely on platform boundaries to keep tenants and firmware separated. If a downstream controller can dynamically reshape address translations, upstream fences may not be sufficient on their own.
Which processors are affected
InfoQ says the issue primarily concerns AMD Family 14h, 15h, and 16h processors, with the registers in question being accessible mainly on older AMD Family 15h and 16h chips. The report also notes that these systems allow Ring 0 software to manipulate the settings, but that this access model is not enough to protect against an adversarial kernel.
That makes the finding especially tied to legacy hardware and low-level platform design, rather than to a broad, universal flaw across all modern systems. Even so, the architectural lesson is important for future designs that depend on rigid memory isolation.
Why hardware teams should care
The report argues that memory controller translation registers should be locked during boot, and that security-critical configuration must be controlled by boundaries above CPU-level privilege. In other words, if the system trusts the kernel to keep the controller honest, the security model may already be too weak for hostile environments.
For hardware and platform engineers, the takeaway is clear: protecting physical memory is not only a question of address-space policy at the CPU. It also depends on what happens after the address leaves the core and reaches the controller, where a different set of logic can reshape the destination entirely.
Security community reaction
The project has already sparked discussion among hardware security and reverse-engineering communities, including Reddit groups such as r/asm and r/blueteamsec, as well as podcasts like SANS ISC Stormcast. Commentary has focused on the implication that platform security fences may be blind to changes in raw physical coordinates once the memory controller begins swizzling them.
At the same time, the report acknowledges practical limits. The exploit requires Ring 0 privileges and targets registers that are chiefly relevant on older AMD systems, which makes it a specialized but still notable example of how low-level memory assumptions can fail.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: August 24, 2026 at 1:53 am
0 views
