SECURITY Signal 443
Domas releases skitter-creek-bath-salts, bypassing AMD CPU memory isolation via DRAM controller registers
↗
Security researcher Christopher Domas released skitter-creek-bath-salts, an open-source tool that manipulates AMD memory controller translation registers to bypass CPU memory isolation on AMD Family 14h, 15h, and 16h processors.
The tool's release means any adversary with kernel-level access on affected AMD platforms can now reach SMM RAM, PSP firmware tables, CC6 sleep save areas, and microcode patch buffers, regions previously assumed to be isolated from the operating system. There is no software patch; the fix Domas proposes requires hardware changes to lock translation registers during boot, leaving operators of bare-metal and confidential-computing workloads to treat any kernel compromise on these CPUs as full platform compromise until silicon changes ship.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
skitter-creek-bath-salts manipulates AMD memory controller translation registers such as BankSwizzleMode to remap physical-to-DRAM addresses beneath the layer where hypervisor EPT, SMM TSEG range limits, and PSP carveouts validate access.
The exploit requires Ring 0 access and runs against AMD Family 14h, 15h, and 16h processors, exposing SMM RAM, PSP firmware tables, CC6 sleep save areas, and microcode patch buffers to a compromised kernel.
No software patch closes the gap; Domas argues hardware teams must lock memory controller translation registers during boot and treat controller configuration as a privilege boundary above Ring 0.
THE CLUSTER