A newly disclosed hardware security vulnerability could undermine one of the most fundamental guarantees that modern processors provide: memory isolation between privileged and unprivileged processes.
Security researcher Christopher Domas published an open-source tool called skitter-creek-bath-salts that demonstrates the attack, which works by manipulating memory controller translation registers — a low-level component of the CPU's DRAM controller responsible for mapping virtual addresses to physical memory locations.
By directly interfering with these translation registers, Domas showed that software running without elevated privileges can break out of its designated memory boundaries and read or write to protected regions that should be inaccessible to it. The technique effectively bypasses the privilege separation mechanisms that operating systems and hypervisors rely upon to keep processes isolated from one another.
Implications for Cloud and Confidential Computing
The vulnerability is particularly concerning in multi-tenant cloud environments, where physical hardware is shared among many customers and strong memory isolation is the primary security guarantee separating their workloads. A guest virtual machine or container that could exploit this flaw might, in principle, access the memory of a neighbouring tenant's workload.
Confidential computing — a growing area of cloud security that uses hardware-enforced trusted execution environments (TEEs) to protect sensitive data even from the cloud provider itself — could also be at risk if the underlying memory controller can be manipulated from outside the protected enclave.
Open-Source Disclosure
Domas chose to release the tool as open-source, following a practice common in hardware security research that allows the broader community to verify findings, develop mitigations, and assess exposure. The tool's publication on its own does not disclose which specific processor families or generations are affected, and detailed chipmaker responses had not been published at the time of writing.
Domas is not a newcomer to hardware security research. He has previously disclosed significant CPU-level vulnerabilities, including work on x86 processor internals presented at major security conferences.
Industry Response Awaited
As of publication, it is not clear whether major processor manufacturers — including Intel, AMD, and ARM — have been notified under responsible disclosure timelines, nor whether microcode or firmware patches are in development. The scope of affected hardware, including which processor generations and memory controller configurations are vulnerable, has not been fully detailed in public disclosures.
The research highlights an enduring challenge in the security of modern computing: as hardware complexity grows, the attack surface at the silicon level expands, and software-layer defences cannot always compensate for vulnerabilities that exist at the architecture level.