A groundbreaking attack technique has surfaced, challenging some of the most robust hardware security measures in modern processors. Discovered by security researcher Christopher Domas and published as an open-source project on GitHub, this attack targets the DRAM controller's address-translation logic, a layer crucial for maintaining memory security. The research demonstrates how the manipulation of this logic can bypass protections surrounding System Management Mode, Platform Security Processor, and CPU microcode memory zones.

Every CPU-generated physical address passes through the DRAM controller, which translates it into raw memory coordinates. Security mechanisms like SEV, SGX, TDX, and TrustZone depend on these addresses remaining fixed once they leave the CPU core. However, Domas's method reveals that this assumption is vulnerable. By altering configuration bits in the memory controller, an attacker can remap how these physical addresses align with actual DRAM cells, a process the research dubs as "spaghettifying" memory. This enables access to memory cells that were previously secured and inaccessible.

The vulnerability arises not from a single flaw but from the linear operation of the address transformation, which can be mathematically reconstructed using basic linear algebra and an SMT solver like Z3, even when undocumented by manufacturers. Domas successfully demonstrated this technique on AMD Family 16h processors, extracting sensitive data like the fTPM's RSA signing routine and System Management Mode interrupt handler, both intended to be isolated from the operating system.

Significantly, the research also shows that a CPU's microcode patch, normally volatile and inaccessible, temporarily resides in DRAM during idle states and can be accessed using this aliasing trick. While the proof of concept focuses on older AMD platforms, the architectural patterns involved are common across modern memory controllers, including those from AMD, Intel, ARM, and RISC-V. This discovery is set to be a major topic of discussion at Black Hat 2026, as researchers and chipmakers work to address this vulnerability class that challenges conventional CPU security frameworks.