Spaghettifying DRAM: Unlock Everything on the CPU
A new exploit targets the DRAM controller's address translation to scramble physical memory, bypassing all higher-level protections. By flipping a single bit in the memory controller, researchers can access hidden regions like the Platform Security Processor, System Management Mode, and CPU microcode. The technique, demonstrated on AMD Family 16h CPUs, uses linear algebra to reconstruct the scrambled memory and works even on modern architectures.
Physical addresses are really more of a suggestion.
- MattSteelblade
I cannot wait for the accompanying Black Hat talk. Christopher Domas is one of my absolute favorite all-time hackers. He does such a fantastic job of explaining his work. Some of my favorite talks of his:
- Psychological Warfare in Reverse Engineering https://www.youtube.com/watch?v=HlUe0TUHOIc
- The MoVfuscator https://www.youtube.com/watch?v=R7EEoWg6Ekk
- Hardware Backdoors in redacted x86 https://www.youtube.com/watch?v=jmTwlEh8L7g
- weinzierl
When I started with computers, DRAM was understandable by a teenager: RAS, CAS, read, done.
Ok, the necessary refresh was always a little pain, but still something manageable.
Nowadays, I feel you need three PhD's to even bring up a micro with DRAM and don't get me started on the proprietary binary blobs necessary just for DRAM access. No wonder PSRAM is a thing.
The corollary is that it shouldn't be too surprising that this gigantic attack surface provides many opportunities. (Of course that doesn't mean it is easy to find them, hat tip to Christopher Domas, just that I expect there to be many more).
- WhiteDawn
This is all great to get full unfettered access to your own system, as life should be.
I’m sure Xbox and PlayStation security groups are a little nervous right now though. Getting ring-0 on those machines is near impossible, but once you do then everything else becomes wide open
- gmueckl
OK, so this works on AMD Jaguar according to the README. That's a architecture from 2013. There's notes about Zen 3 having a different base address for the memory controller registers, but that's it. What newer CPUs does attack actually work on?
- dzdt
So on an affected system, ring 0 root has access to pretty much everything that was hidden in negative ring territory. The page is pretty quiet about what other processor families might be similar beyond this specific AMD16h (an older AMD low-power family)?
- zahlman
This is only applicable if you already have root (in order to get beyond that), right? It doesn't expose new risk of local privilege escalation?
- raver1975
I spaghettify my memory every time I write C code.
- matheusmoreira
So what's inside Intel ME, AMD PSP and associaded firmwares? Don't leave us hanging here...