A security researcher has shown that AMD’s memory scrambling can be weaponized to undo CPU isolation. Christopher Domas released the open-source project, skitter-creek-bath-salts, this week.
The attack lives in the DRAM controller, the layer below every other security boundary. On AMD Family 14h, 15h and 16h processors, Ring 0 software can rewrite how physical addresses map to memory banks. Because the remapping happens beneath the controller, defenses such as hypervisor Extended Page Tables, System Management Mode TSEG limits and Platform Security Processor carveouts stay blind to it.
Pulling data out without taking down the machine demands a staged pipeline. A custom kernel module takes non-boot CPU cores offline, flushes caches, pre-warms the translation lookaside buffer and disables interrupts so memory stays put during the rewiring. Probing scripts then map the scrambled layout with a coupon-collector approach.
The finding sharpens the line between CPU privilege and platform privilege. Hardware security and reverse-engineering communities have latched onto the project, and the authors warn that bare-metal cloud and confidential computing tenants may be exposed to a platform they assumed was trustworthy.
