New technique "skitter-creek-bath-salts" bypasses DRAM memory protections on AMD CPUs

DRAM Scrambling Technique Unveiled

A new method, dubbed "skitter-creek-bath-salts," has been developed to manipulate DRAM controller registers, enabling the scrambling of platform memory. This manipulation allows an address to be directed to any location in memory, effectively bypassing established memory protections.

Bypassing Core Security Features

By rewiring physical DRAM address translations, the technique can unlock various guarded secrets of the CPU. This includes gaining access to the Platform Security Processor (PSP), System Management Mode (SMM), C6 DRAM, and CPU microcode, which are typically invisible even to the operating system kernel.

Applicability and Limitations

The "skitter-creek-bath-salts" technique was developed and tested on AMD Family 16h CPUs. These processors are notable as the last generation for which the datasheets document the DRAM controller's translation registers and confirm they cannot be locked. Later generations, such as 17h and beyond, omit this critical information from their documentation. The underlying principles of memory transformation are suggested to extend to other architectures like ARM and RISC-V.

Memory Abstraction Layers

The method exploits the complex layers of abstraction within memory management. When software accesses a virtual address, it undergoes a series of translations and checks, including virtual-to-physical address translation, TLB probes, and page walks, before reaching the physical DRAM. The technique targets the deepest level of this hierarchy, where physical DRAM address translations occur.