Security researcher Christopher Domas published a proof of concept showing how AMD memory controllers' bank swizzle mode can be exploited to bypass memory protection, enabling arbitrary reads and writes including CPU microcode definitions and platform security processor memory. This lets kernel-level code manipulate the meaning of processor instructions, potentially undermining memory encryption and virtual machine isolation. The behavior is documented in AMD's manual, but using it to rewrite supposedly immutable firmware without crashing the machine appears to be an unintended consequence of the design. Exploitation requires kernel-level privileges, limiting immediate risk, though the technique could eventually be weaponized.
Questions this post answers
What is AMD's bank swizzle mode and how can it be used to bypass memory protection?
Bank swizzle mode is a documented feature of AMD memory controllers, described on page 113 of AMD's programmer reference manual, that can be exploited to read or write arbitrary memory, including CPU microcode definitions and platform security processor memory. Kernel-level code can use it to rewrite immutable firmware without crashing the machine, potentially bypassing memory encryption and virtual machine isolation, though enabling it requires kernel-level privileges. Follow daily.dev for research on low-level hardware exploits affecting AMD systems and kernel security.