Loading story…
Security researcher Christopher Domas disclosed a hardware attack that abuses DRAM controller address-translation and scrambling logic to remap physical memory, allowing protected regions to alias into accessible addresses on older AMD processors. The technique was demonstrated against AMD Family 16h chips, where Domas reportedly extracted data from Platform Security Processor (PSP) memory, read System Management Mode contents from SMRAM, and recovered CPU state written to DRAM during C6 idle transitions, undermining isolation below the CPU core.
Reports say the weakness is tied to a "swizzle"-style memory-mapping mechanism and can also weaken protections associated with AMD memory-encryption technologies such as SME/SEV under certain conditions. The affected processor family includes chips used in PlayStation 4 and Xbox One systems, while AMD Family 17h and later Zen-based processors are described as having architectural changes that mitigate or block this attack path. Domas characterized the issue as a broader class of architectural risk because similar memory-controller mapping designs are used across multiple CPU ecosystems, and the research is being released as the open-source project skitter-creek-bath-salts ahead of a Black Hat presentation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
At Black Hat 2026, researchers presented findings on a hardware memory-protection weakness in older AMD processors involving a swizzle-based memory-address transformation. The presentation described how the issue could undermine PSP-linked protections and AMD SME/SEV memory encryption on AMD Family 16h systems, while noting that AMD Family 17h and newer architectures introduced changes that mitigate this attack path.
AMD published a security bulletin acknowledging the Skitter Creek Bath Salts issue affecting older Family 15h and 16h processors. AMD said the impacted chips are out of security support and that exploitation requires an attacker who already has kernel-level code execution on the machine.
Christopher Domas disclosed research on a DRAM-controller address-translation attack that can bypass hardware-enforced memory isolation by remapping physical addresses to protected DRAM cells. He released the work as the open-source project skitter-creek-bath-salts and demonstrated it on AMD Family 16h processors, including reads from PSP memory, SMRAM, and CPU state saved during C6 idle transitions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcetomshardware.com
Open sourceopennet.me
Open sourceopennet.ru
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from the University of Birmingham and Durham University disclosed **"Download More RAM,"** a software-only attack that rewrites writable SPD EEPROM data on certain DDR4 and DDR5 DIMMs over SMBus/I2C, causing memory to falsely report more capacity and creating aliased physical memory regions on Windows 11 systems. With **local administrator privileges**, an attacker can use the aliased region to read and write protected memory, patch Secure Kernel Code Integrity, and bypass defenses including **VBS**, **HVCI**, **DSE**, and **PatchGuard**; the technique was also shown disabling **Microsoft Defender** and **Sophos Intercept X**, modifying VBS enclaves, bypassing anti-cheat protections, and enabling blocked vulnerable drivers to load. Microsoft tracked the issue as **`CVE-2026-23670`** and shipped mitigations in its April 2026 security updates, including blocking the demonstrated stabilization method, disabling the `removememory` boot parameter on Secure Boot systems, and extending VBS protections to some systems without Secure Boot. The researchers said the mitigation is partial and that systems lacking Secure Boot may remain exposed if alternative stabilization methods are found. The affected hardware identified in the research includes consumer DIMM lines from **Corsair, G.Skill, and ADATA** with SPD write protection disabled.
Aug 16, 2026
AMD disclosed the high-severity **SinkClose** processor vulnerability, tracked as `CVE-2023-31315`, affecting a broad range of AMD CPUs manufactured since 2006. The flaw can be exploited by an attacker who already has kernel-level access to manipulate System Management Mode (SMM) configuration, bypass SMM lock protections, and execute arbitrary code at the highly privileged **Ring -2** level. Researchers Enrique Nissim and Krzysztof Okupski of IOActive showed multiple exploitation paths, including abuse of the **TSeg** protection mechanism and access to sensitive data stored in **SMRAM**. AMD directed customers to obtain product-specific **BIOS updates** from their OEM or system vendor as the primary mitigation for affected platforms.
Jul 24, 2026
Researchers reported that **Rowhammer** remains a practical hardware security threat, with the newer **Phoenix** technique showing that **DDR5** memory can still be manipulated despite built-in protections. The attack revives a flaw first highlighted by Google Project Zero, which demonstrated that repeatedly accessing DRAM rows could trigger adjacent bit flips and be weaponized for **privilege escalation** on x86 systems, including a Linux kernel exploit that altered page table entries and a sandbox escape from **Google Native Client**. The newer findings indicate that DDR5 mitigations have not eliminated the underlying risk, extending concerns that began with widespread **DDR3** exposure across tested laptop models. Earlier research had already shown Rowhammer was more than a reliability issue, and the latest reports suggest modern memory modules remain susceptible to carefully engineered disturbance attacks that can undermine isolation boundaries and system integrity, renewing pressure on hardware vendors to disclose affected products and strengthen defenses.
Jun 29, 2026