Loading story…
Researchers from the University of Birmingham and Durham University disclosed "Download More RAM," a software-only attack that rewrites writable SPD EEPROM data on certain DDR4 and DDR5 DIMMs over SMBus/I2C, causing memory to falsely report more capacity and creating aliased physical memory regions on Windows 11 systems. With local administrator privileges, an attacker can use the aliased region to read and write protected memory, patch Secure Kernel Code Integrity, and bypass defenses including VBS, HVCI, DSE, and PatchGuard; the technique was also shown disabling Microsoft Defender and Sophos Intercept X, modifying VBS enclaves, bypassing anti-cheat protections, and enabling blocked vulnerable drivers to load.
Microsoft tracked the issue as CVE-2026-23670 and shipped mitigations in its April 2026 security updates, including blocking the demonstrated stabilization method, disabling the removememory boot parameter on Secure Boot systems, and extending VBS protections to some systems without Secure Boot. The researchers said the mitigation is partial and that systems lacking Secure Boot may remain exposed if alternative stabilization methods are found. The affected hardware identified in the research includes consumer DIMM lines from Corsair, G.Skill, and ADATA with SPD write protection disabled.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers from the University of Birmingham and Durham University presented the 'Download More RAM' attack at the 35th USENIX Security Symposium in Baltimore. They described it as a software-only memory aliasing attack against certain DDR4 and DDR5 DIMMs that can bypass Windows protections including VBS and HVCI.
Microsoft released mitigations in its April 2026 security update for CVE-2026-23670, including blocking the demonstrated use of the removememory boot parameter on Secure Boot systems. The mitigation was described as partial, with systems without Secure Boot still vulnerable according to the research coverage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researcher Christopher Domas disclosed a hardware attack that abuses DRAM controller address-translation and scrambling logic to remap physical memory, allowing protected regions to alias into accessible addresses on older AMD processors. The technique was demonstrated against **AMD Family 16h** chips, where Domas reportedly extracted data from **Platform Security Processor (PSP)** memory, read **System Management Mode** contents from `SMRAM`, and recovered CPU state written to DRAM during `C6` idle transitions, undermining isolation below the CPU core. Reports say the weakness is tied to a "swizzle"-style memory-mapping mechanism and can also weaken protections associated with AMD memory-encryption technologies such as **SME/SEV** under certain conditions. The affected processor family includes chips used in **PlayStation 4** and **Xbox One** systems, while **AMD Family 17h** and later Zen-based processors are described as having architectural changes that mitigate or block this attack path. Domas characterized the issue as a broader class of architectural risk because similar memory-controller mapping designs are used across multiple CPU ecosystems, and the research is being released as the open-source project **skitter-creek-bath-salts** ahead of a Black Hat presentation.
Aug 15, 2026
Researchers reported that **Rowhammer** remains a practical hardware security threat, with the newer **Phoenix** technique showing that **DDR5** memory can still be manipulated despite built-in protections. The attack revives a flaw first highlighted by Google Project Zero, which demonstrated that repeatedly accessing DRAM rows could trigger adjacent bit flips and be weaponized for **privilege escalation** on x86 systems, including a Linux kernel exploit that altered page table entries and a sandbox escape from **Google Native Client**. The newer findings indicate that DDR5 mitigations have not eliminated the underlying risk, extending concerns that began with widespread **DDR3** exposure across tested laptop models. Earlier research had already shown Rowhammer was more than a reliability issue, and the latest reports suggest modern memory modules remain susceptible to carefully engineered disturbance attacks that can undermine isolation boundaries and system integrity, renewing pressure on hardware vendors to disclose affected products and strengthen defenses.
Jun 29, 2026
Researchers disclosed two signed Windows kernel drivers that can be abused in **bring-your-own-vulnerable-driver (BYOVD)** attacks to gain elevated privileges and bypass platform protections. Motorola's `SmSerl64.sys` from the SM56 Modem WDM Driver package (`6.12.23.0`) was reported as vulnerable to crafted `IOCTL` requests that let low-privileged users map physical memory, enabling privilege escalation, high-privilege code execution, and information disclosure; the issue is tracked as **`CVE-2024-55414`**. Separately, Patrick Saif reported that `ComputerZ_x64.sys`, shipped with Chengdu Qilu Technology's widely distributed Master Lu utility, exposes dangerous kernel primitives including arbitrary physical memory reads, unrestricted `MSR` reads that can defeat `KASLR`, weakly filtered port I/O, and unrestricted PCI configuration writes. Both drivers are signed and therefore attractive for abuse on systems that enforce driver-signing requirements. The Master Lu driver reportedly is not on Microsoft's `HVCI` blocklist and can load on modern x64 Windows systems, while the Motorola driver has been added to LOLDrivers with recommendations to block `SmSerl64.sys` across endpoints and use published **YARA** and **Sigma** detections. In testing, the Master Lu proof of concept reportedly succeeded in loading the driver, accessing the device, reading `IA32_LSTAR`, reading physical memory, and performing PCI and port I/O operations, underscoring the risk that legitimate but vulnerable drivers can provide attackers with direct kernel-level capabilities.
Jun 29, 2026