SECURITY Signal 444
AMD 15h/16h CPUs: flipping BankSwizzleMode bit with one instruction exposes PSP, SMM, and microcode
↗
A single instruction toggling BankSwizzleMode on AMD 15h/16h CPUs lets kernel-level attackers access normally hidden memory regions including PSP, SMM, and microcode.
The exploit requires kernel-level access, so an attacker already controls the machine, but it grants full hardware-level control over DRAM contents, including fTPM signing code. These chips are out of security support, so no fix is coming. It highlights how a single bit in a memory-mapped configuration register can break the isolation of protected memory regions.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The exploit targets AMD 15h and 16h families, roughly 2011-2015, including FX, Opteron, Jaguar/Puma SoCs.
It works by toggling BankSwizzleMode via a single instruction, then mapping memory to access hidden areas.
Requires kernel-level access, meaning the attacker already has significant control, and AMD has no security support for these chips.
THE CLUSTER