Security researcher Christopher Domas has unveiled skitter-creek-bath-salts, an open-source {hardware} safety venture that dismantles conventional CPU privilege boundaries by focusing on the bottom layer of the bodily reminiscence hierarchy. By manipulating reminiscence controller translation registers, the software dynamically alters physical-to-DRAM handle mappings on the {hardware} logic stage. This permits unprivileged software program to entry remoted platform reminiscence areas with out triggering upstream architectural reminiscence fences or fault exceptions.
Trendy processor safety architectures assume that bodily addresses map deterministically to particular silicon storage places. Commonplace safety boundaries—together with hypervisor Extended Page Tables, System Management Mode TSEG range limits, and Platform Safety Processor (PSP) personal carveouts—function on the core and system material interconnect layer, earlier than reminiscence site visitors reaches the controller. Domas found that reminiscence controller translation registers sit beneath these access-control fences. Manipulating configuration bits, reminiscent of BankSwizzleMode, basically modifications how the controller calculates DRAM financial institution, row, and column coordinates. As a result of upstream safety filters solely validate the untranslated bodily handle, these bit-flips permit customary reminiscence accesses to land silently inside protected {hardware} enclaves.
To extract knowledge from scrambled reminiscence with out destabilizing the host OS, the exploit makes use of a multi-stage software program pipeline. A customized Linux kernel module offlines non-boot CPU cores, flushes system caches, pre-warms translation lookaside buffers, and disables interrupts to make sure reminiscence stability throughout rewiring. Automated probing scripts then use a coupon-collector heuristic, mixed with focused userspace reads, to catalogue handle bit collisions. The accompanying toolchain fashions the bodily handle permutation utilizing Galois Area arithmetic and employs an SMT solver to derive the precise bitwise mapping. As soon as the map is resolved, the exploit executes focused learn/write bursts in opposition to beforehand impenetrable enclaves, together with System Administration Mode (SMM) RAM, PSP firmware tables, CC6 processor sleep save areas, and microcode patch buffers.
These findings expose a important architectural blind spot: upstream safety checks can not assure integrity if downstream reminiscence controller logic permits dynamic handle swizzling, posing dangers to bare-metal cloud and confidential computing. This vulnerability highlights the very important distinction between CPU and platform privilege. Whereas AMD Household 14h, 15h, and 16h processors permit Ring 0 software program to govern these configurations, this entry stage is basically inadequate, because it treats the kernel as inherently trusted. To safe future methods, {hardware} groups should guarantee reminiscence controller translation registers are strictly locked throughout boot, as the truth of adversarial kernels calls for that security-critical platform configuration be managed by boundaries elevated above CPU-level privilege.
{Hardware} safety and reverse-engineering communities on Reddit (e.g., r/asm and r/blueteamsec) and podcasts like SANS ISC Stormcast have responded to the venture with important curiosity. Discussions have centered on the architectural implications of the invention, noting that as a result of platform safety fences exist above the reminiscence controller, they continue to be oblivious to the scrambling of uncooked bodily coordinates. Specialists additionally emphasize the sensible limitations of the exploit, which requires Ring 0 privileges and targets registers primarily accessible on older AMD Household 15h and 16h processors.
