SECURITY Signal 538
Domas: Bypassing memory protection with AMD's memory controllers
↗
Illustration only Photo by Michael Dziedzic on Unsplash
Christopher Domas published a proof of concept demonstrating that AMD memory controllers' documented bank swizzle mode can bypass memory protection to read or write arbitrary data, including CPU microcode and platform security processor memory.
This technique allows kernel-level code to manipulate processor instruction meanings and potentially bypass memory encryption and VM isolation. While requiring kernel privileges limits immediate exploitation, the documented behavior's unintended side-effects make it likely to be used in future attacks targeting firmware and secure processor memory.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
AMD memory controllers' bank swizzle mode can bypass memory protection to access arbitrary data including CPU microcode and platform security processor memory.
The behavior is documented in AMD's manual but the ability to rewrite supposedly immutable firmware without crashing appears unintentional.
Exploitation requires kernel-level privileges, limiting immediate risk but not eliminating future attack potential.
THE CLUSTER