New DRAM Scrambling Attack Exposes CPU’s Most Protected Memory Zones

HomeCyber Security New DRAM Scrambling Attack Exposes CPU’s Most Protected Memory Zones By Guru Baran August 14, 2026 A new attack technique that manipulates a computer’s memory controller to bypass some of the strongest hardware security boundaries built into modern processors, including protections around System Management Mode, the Platform Security Processor, and CPU microcode. The research, published as an open-source project called skitter-creek-bath-salts on GitHub by Security researcher Christopher Domas, has unveiled a striking attack targeting a layer of the system beneath almost every existing defense mechanism: the DRAM controller’s address-translation logic. Every physical address a CPU generates eventually passes through this controller, which remaps it into raw memory coordinates a specific bank, rank, row, and column inside the DIMM. Security features like SEV, SGX, TDX, TrustZone, and firmware-based memory carveouts all rely on physical addresses staying fixed and predictable once they leave the CPU core. Domas’s technique shows that assumption can be broken with a single instruction. DRAM Scrambling Attack By flipping specific configuration bits in the memory controller, an attacker can rewrite how physical addresses map onto actual DRAM cells, a process the research describes as “spaghettifying” memory. Once this remapping is altered, a completely different address can be made to point at the exact same physical memory cell that was previously fenced off and inaccessible. Because every access-control mechanism above the memory controller checks physical addresses rather than the underlying DRAM coordinates, none of those protections notice when the underlying map changes. Crucially, this class of vulnerability is not tied to a single flaw that can simply be patched. According to the research, the attack works because the address transform performed by the memory controller is a linear operation over GF(2), meaning it can be mathematically reconstructed using basic linear algebra, aided by an SMT solver such as Z3, even when the exact remapping is undocumented by the manufacturer. Domas demonstrated the technique on AMD Family 16h processors, extracting the fTPM’s RSA signing routine directly from Platform Security Processor memory that is supposed to be completely isolated from the operating system. The same method pulled the System Management Mode interrupt handler out of SMRAM, a memory region marketed as “locked” by the chipset, and recovered raw CPU register state, including page-table roots and APIC configuration, stashed in DRAM while cores sit in the C6 low-power idle state. Perhaps most significantly, the research shows that a CPU’s active microcode patch, normally volatile and inaccessible, is temporarily written to DRAM during idle transitions and can be both read and overwritten using the same aliasing trick. While the proof-of-concept published on GitHub targets an older AMD platform whose datasheets happened to document enough of the controller’s registers to reverse-engineer the transform, Domas notes the same architectural pattern- channel and rank interleaving, bank swizzling, and chip-select mapping- exists across virtually every modern memory controller, spanning AMD, Intel, ARM, and RISC-V designs. The findings will be presented in detail at Black Hat 2026, and researchers are expected to closely monitor how chipmakers address a vulnerability class that lies beyond the reach of traditional CPU security models.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Cyber Security Guide Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways  Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response  Latest Cyber News Cyber Security News Fortinet Patches Multiple Authentication Vulnerabilities in FortiWeb, FortiManager, and FortiClient Cyber Security News Beacon CRM Confirms Full Database Theft After AWS Access Key Breach Cyber Attack News AmnesiaStealer macOS Malware Hijacks Browser Sessions via Fake GitHub Lure Cyber Security News Microsoft Exchange Server Vulnerabilities Enable DoS, Privilege Escalation, and RCE Attacks Cyber Security Trezor ShipMonk Data Breach Exposes Personal Data of Over 13,000 Hardware Wallet Customers Expert Talks Expert Talks From Reactive Forensics to Predictive Defence: Strengthening Cyber Resilience in Banking  Expert Talks Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage  Expert Talks Your Incident Response Plan Has a Dependency You Never Approved Expert Talks Security in the AI Era Starts with First Principles  Cyber Security News Planning Your AI Security – How will You Manage All Your Resources?