Side channel allows access to RAM of the AMD security controller PSP

A new security vulnerability has been discovered in older AMD processors, allowing unauthorized access to reserved memory areas used by critical security functions. The flaw, named “skitter-creek-bath-salts,” was identified by researcher Christopher Domas, known online as “xoreaxeaxeax.” According to his findings, this vulnerability affects AMD processors from the Family 16h series, which were introduced around 13 years ago. These processors include models such as Kabini, Temash, Beema, and Mullins, all based on the Jaguar architecture and released between 2013 and 2014. They are commonly found in budget-friendly tablets, notebooks, and embedded systems. The vulnerability exploits weaknesses in how these processors manage physical and virtual memory addresses. Specifically, it targets the DRAM controller configuration register D18F2x94, which is documented in the BIOS and Kernel Developer’s Guide (BKDG) for Family 16h models. By manipulating this register, attackers can bypass the isolation mechanisms designed to protect sensitive memory regions used by components like the AMD Platform Security Processor (PSP), System Management Mode (SMM), and CPU microcode. This allows them to read from and write to memory areas typically reserved for secure operations, including those containing cryptographic keys and other confidential data. The PSP, later renamed the AMD Secure Processor, plays a crucial role in protecting key materials used in encryption and other security features. It forms the basis for technologies like AMD Secure Encrypted Virtualization (SEV), which aims to safeguard virtual machines. However, the vulnerability reveals that even with these protections, certain memory regions remain accessible due to flaws in address management. The ARM Cortex-A5 core within the PSP uses a small portion of the installed DRAM exclusively, which is hidden from both the operating system and BIOS through the processor’s built-in memory controller. To exploit the vulnerability, attackers must manipulate the complex mapping between physical and virtual memory addresses. This requires software capable of reversing the multiple layers of address translation used in x86 architectures. The code developed by Domas demonstrates how these transformations can be reversed, effectively exposing protected memory regions. His work highlights that while the “skitter-creek-bath-salts” flaw does not directly expose the same risks as the previously known “skitter-creek-bath-salts” vulnerability, where admin rights were required to manipulate the DRAM controller, it still poses a serious threat to systems using older AMD processors. Similar attacks have targeted other hardware components, such as Intel’s Management Engine (ME), where researchers successfully accessed restricted memory areas in 2020. Another example is the BatteringRAM attack, which manipulated memory addresses to gain access to secure regions used in confidential computing. These incidents underscore the ongoing challenges in securing memory-based systems against sophisticated attacks. While AMD has documented the use of the D18F2x94 register in its BKDG, it appears that documentation for newer CPU families is less comprehensive. This lack of transparency could hinder efforts to fully assess the scope of potential vulnerabilities across different generations of AMD processors. As a result, further research is needed to determine whether similar issues exist in more recent chip designs. For now, users running systems based on the affected Family 16h processors should consider implementing additional security measures to mitigate the risk posed by this newly uncovered flaw.