When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
The exploit is called Skitter Creek Bath Salts (Skitter), and was developed by prolific hacker Christopher Domas, famous for finding CPU flaws like Sandsifter and God Mode Unlocked . Only AMD chips from the 15h and 16h families are affected, roughly 2011 to 2015 vintages. Family 15 is FX-series desktop chips and some Opterons, while 16h includes low-power Jaguar- and Puma-based SoCs like those in the PlayStation 4 and Xbox One, plus a handful of Athlon, Sempron, and Opteron-X chips, among others.
To pull off this exploit, you'll need kernel-level access, meaning the ability to run your own drivers . But once you do, the entirety of DRAM is your oyster. AMD published a security bulletin on the matter, saying these chips are out of security support, plus, as mentioned, the necessary access level means an attacker already controls the machine anyway.
If you're confused as to how one instruction opens up a system, here's our attempt at a simplification. Say you have 16 GB of RAM. You'd think that Windows gets all 16 GB to play with, from address 0 to the end of memory — but as you may have noticed before, it's actually a bit less than that. The rest is reserved for system-level data.
Some parts are visible to the OS so it can interact with devices, but others include Very Important Things like PSP, SMM, microcode patches, all in sections supposed to be completely untouchable. If they were accessible, the system as a whole wasn't secure by definition anymore — just think of a malicious driver being able to freely mess with how your processor handles data.
AMD silently removes memory encryption from consumer Ryzen CPUs, leaving users unaware that they may be vulnerable
Researchers bypass AMD SEV-SNP protections with “Fabricked” Infinity Fabric attack
First Apple M5 memory exploit discovered using Anthropic AI, gives root access on MacOS
For performance reasons, modern processors' RAM controllers don't use memory in a straight line, so to speak — they use bank interleaving, meaning that the actual bytes in the DRAM are jumbled, all while the OS sees a nice, tidy, flat surface. As it turns out, the CPU setting that controls this feature is accessible to the OS in the aforementioned chip families, and it's called BankSwizzleMode (Swizzle). It can be toggled on or off with the instruction "xor dword [0xf80c2094], 0x00400000", a simple bit twiddle. And as it turns out, this can be exploited.
First, you run a loop to figure out how the mapping normally functions. You place a canary value in memory (say, 0xDEADBEEF, according to tradition), disable Swizzle, run through memory to see where it landed, and reenable Swizzle again. Do this enough times, and you know exactly how visible memory is mapped into physical DRAM, and vice-versa.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/just-one-instruction-on-amds-2015-era-cpus-gets-you-access-to-platform-security-processor-microcode-and-system-management-interface-exploit-for-15h-and-16h-chip-families-cracks-open-secret-memory-areas#main
- https://www.tomshardware.com/membership
- Industry Leaders Unite in Open Secure AI Alliance for AI Safety and Security
- NVIDIA Joins NSF State and Regional AI Hubs Program to Expand AI Research and Education Across the US
- GeForce NOW Shakes Up August With 26 New Games
- Just one instruction on AMD's 2015-era CPUs gets you access to Platform Security Processor, microcode, and System Management Interface — exploit for 15h and 16h
- Razer Naga V3 Pro Review: My new 23-button mouse
Informational only. No financial advice. Do your own research.