The AMD Skitter exploit is a reported technique that lets code already running with kernel privileges reach protected memory areas on certain AMD processors from roughly 2011 through 2015. Researcher Christopher Domas developed the technique, called Skitter Creek Bath Salts or Skitter, according to Tom’s Hardware. The catch is substantial: an attacker must already be able to load and run a driver on the machine. This is post-compromise hardware control, not a remote break-in or an ordinary-user privilege escalation.
The reported target is AMD processor families 15h and 16h. Family 15h covers FX desktop chips and some Opterons; 16h includes low-power Jaguar- and Puma-based systems-on-chip, along with certain Athlon, Sempron and Opteron-X products. Those families include chips used in PlayStation 4 and Xbox One hardware, but the report does not establish that either console is exploitable.
How does the AMD Skitter exploit work?
According to Tom’s Hardware, the affected chips expose a memory-controller control called BankSwizzleMode through operating-system-accessible memory-mapped configuration space. Memory-mapped configuration means an apparent memory address can operate a hardware register rather than point to ordinary RAM.
Bank swizzling is part of how the memory controller distributes data across DRAM banks while presenting software with a tidy address range. Skitter toggles that setting with the instruction xor dword [0xf80c2094], 0x00400000, then repeatedly compares where a known test value appears with swizzling enabled and disabled. That process builds a map between normal visible addresses and physical DRAM locations.
With that map, kernel-level code can disable swizzling and aim reads or writes at areas normally kept outside the operating system’s reach, the report says. For a refresher on why RAM addresses matter to running software, see our guide to computer memory.
- Reported accessible targets: memory associated with the Platform Security Processor, firmware TPM, System Management Mode and microcode patch RAM.
- Prerequisite: kernel-level execution, including the ability to run a driver.
- Operational risk: the mapping phase can crash a system; the report says targeted access after mapping is less likely to do so.
- Support status: AMD said the affected processors are outside security support, according to Tom’s Hardware.
Why the protected regions matter
The Platform Security Processor, now generally called the AMD Secure Processor, is an embedded security processor that starts before the main x86 cores and helps handle boot and security functions. Researchers describing the subsystem say it runs proprietary, largely undocumented firmware; on applicable systems, firmware TPM services run there. System Management Mode and microcode patch memory also sit below the normal operating-system trust boundary.
That is why the claimed access is serious after kernel compromise. A malicious driver would be in a position to inspect or alter data that the normal operating system is not meant to touch. Still, the prerequisite changes the practical reading: Skitter does not provide the missing first foothold on a machine. AMD’s reported position is that someone able to exploit it has already taken control at the kernel level.
The available reporting does not identify a patch, workaround, CVE or affected processors beyond families 15h and 16h. It also provides no basis for treating newer AMD systems as in scope.
This story draws on original reporting from Tom's Hardware.
