{"id":182995,"date":"2026-08-14T10:53:40","date_gmt":"2026-08-14T08:53:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/obhod-izolyaczii-pamyati-na-sistemah-s-cpu-amd-cherez-manipulyaczii-s-kontrollerom-pamyati"},"modified":"2026-08-14T10:53:42","modified_gmt":"2026-08-14T08:53:42","slug":"bypassing-memory-isolation-on-amd-cpu-systems-via-memory-controller-manipulation","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/bypassing-memory-isolation-on-amd-cpu-systems-via-memory-controller-manipulation","title":{"rendered":"Bypass Memory Isolation on AMD CPU Systems through Memory Controller Manipulations","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
At the Black Hat 2026 conference, a new attack method was demonstrated, utilizing the swizzle mode of AMD memory controllers to bypass memory isolation and read or write arbitrary data from memory, including areas containing CPU microcode and memory allocated to the Platform Security Processor (PSP). This method allows for the circumvention of built-in memory encryption mechanisms (AMD SME\/SEV), disrupts the isolation of virtual machines, and rewrites the processor microcode. Manipulations with the memory controller require code execution at the kernel level, which lowers the potential risk of the demonstrated attack technique. <\/p>\n
The 'swizzle' mode alters the addressing logic of the RAM to prevent conflicts that arise during sequential access when reading from different rows within the same memory bank. To avoid such conflicts, the controller applies an XOR operation to part of the address bits in 'swizzle' mode, distributing consecutively accessed data blocks across different memory banks. The attack involves manipulating the 'swizzle' mode on a running system to dynamically redistribute physical addresses. <\/p>\n
The attack prototype was showcased on AMD processors from the 16h family, used in PS4 and Xbox One consoles, where the address configuration registers of the memory controller were documented and the mechanism to block them post-system boot was absent. In AMD processors from the 17h family and newer (starting with Zen), AMD implemented a blocking mechanism for accessing the configuration registers of the memory controller and added protection against substitution of the microcode copy that gets loaded into memory during the processor's transition to sleep mode (C6). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"