The Hack That Hijacks Your CPU's Wiring

Security researcher Christopher Domas unveiled a groundbreaking exploit, Skitter Creek Bath Salts, which operates entirely below the operating system. This novel attack bypasses conventional defenses by never touching software layers. It fundamentally redefines what "unhackable" means for modern CPUs.

The core principle of Skitter Creek Bath Salts is deceptively simple but devastatingly effective. It doesn't rely on malware or software vulnerabilities. Instead, Domas discovered that a single XOR instruction against a configuration register in specific AMD chips can flip a bit within the DRAM controller. This action silently remaps where every address in the system physically points, fundamentally altering the physical memory layout.

This manipulation occurs without the CPU, OS, or any other on-chip component detecting it. All security features, including the Platform Security Processor and System Management Mode, guard logical addresses. But none were designed to anticipate a rerouting of the underlying physical wiring.

The stealth of this attack is absolute. No processes run, and no code executes at a level visible to monitoring tools. Domas’s method leaves no software trace, making it a ghost in the machine’s wiring, invisible to even the most sophisticated detection systems. He successfully extracted RSA routines from locked Platform Security Processor memory and microcode.

At the core of the "Skitter Creek Bath Salts" exploit, Christopher Domas uncovered a startling vulnerability within specific AMD chips. A single XOR instruction, when directed at a particular configuration register, flips a critical bit in the integrated memory controller. This seemingly innocuous action has profound consequences.

This bit flip instantly and silently remaps the physical addresses of every memory location across the entire system. Neither the CPU nor the operating system registers this fundamental change. It's akin to a librarian covertly reshuffling every book's shelf location without updating the catalog or informing patrons.

Domas’s attack leverages this silent rerouting with surgical precision. An attacker first executes the XOR instruction, instantly reconfiguring the memory map. They then read secret data from a now-exposed physical memory location, knowing precisely where sensitive information, like the RSA encryption routine from the Platform Security Processor or handler code from System Management Mode, now resides.

Crucially, the attacker flips the bit back to its original state before any downstream process or monitoring tool can detect the brief, but devastating, shift. Because no code executes at the software layer, traditional security measures designed to guard logical addresses remain entirely blind to this physical rewiring.

CPU manufacturers design an array of sophisticated hardware features to protect sensitive operations and data, creating what were considered impenetrable fortresses. These include Secure Encrypted Virtualization (SEV), Software Guard Extensions (SGX), the Platform Security Processor (PSP), and System Management Mode (SMM), all engineered to compartmentalize and secure critical code execution and memory regions.

These protective measures, however, share a fundamental blind spot. They all operate on the premise of guarding memory addresses, assuming the underlying physical wiring and memory mapping within the chip remain immutable and trustworthy. The Skitter Creek Bath Salts exploit shatters this core assumption by silently remapping physical locations below these hardware fortresses.

Christopher Domas demonstrated this vulnerability's profound impact. He extracted the RSA encryption routine directly from the PSP's supposedly locked memory. He also successfully read handler code operating within the CPU's most privileged System Management Mode, alongside the chip's own microcode. For a deeper dive into his methods and findings, consult the xoreaxeaxeax/skitter-creek-bath-salts: Unlocking _everything_ on the CPU with DRAM scrambling - GitHub repository.

Christopher Domas's publicly available code for Skitter Creek Bath Salts currently targets older AMD chips. This specific version requires documented configuration registers to identify the precise bit within the memory controller responsible for address remapping. This dependency limits its immediate applicability to systems where such low-level hardware details are publicly known.

But the implications extend far beyond these specific, older AMD models. Researchers widely believe the underlying weakness—a memory controller that can silently remap physical addresses—persists in nearly Every modern CPU architecture. This design, intended for performance or flexibility, introduces a profound vulnerability by allowing critical hardware wiring to be altered below all software and firmware layers.

Domas's research represents a profound paradigm shift in hardware security. It exposes a massive blind spot, demonstrating that even robust, supposedly 'unbreakable' features like the Platform Security Processor and System Management Mode are predicated on a flawed assumption: that physical memory addresses remain static. This finding necessitates a fundamental re-evaluation of architectural security design, urging engineers to move beyond software-centric protections and address vulnerabilities rooted in the very physical wiring of our chips.

What is the Skitter Creek Bath Salts exploit?

It is a proof-of-concept hardware attack by researcher Christopher Domas that manipulates a CPU's DRAM controller to secretly remap physical memory, bypassing all software and hardware security layers.

How does this attack bypass features like SGX or SEV?

Security features like SGX and SEV protect data at specific memory addresses. This attack operates below them by changing where those addresses physically point to on the memory chip, a threat they were not designed to counter.

Which CPUs are vulnerable to this attack?

The specific public proof-of-concept works on older AMD chip families (15h/16h) where the necessary registers were documented. However, the underlying architectural weakness is believed to exist in most modern CPUs with configurable memory controllers.

Is this attack detectable?

No. Because the exploit manipulates hardware state directly and does not execute any code or run a process at the software layer, it is invisible to operating systems and traditional security monitoring tools.