Physical Memory Desync Attacks, Bypassing OS Isolation via Unprotected SPD Chips.

This week we take a look at: Physical Memory Desync Attacks, Bypassing OS Isolation via Unprotected SPD Chips.

Let's dive in.

Modern operating systems—including Windows 11 with Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI)—rely on a foundational hardware assumption: and that is the physical address space mapped by memory management units (MMUs) and page tables accurately and immutably reflects installed physical memory.

In a paper that has drawn award-winning attention presented at the USENIX Security Symposium 2026 (August 13, 2026), researchers from the University of Birmingham and Durham University demonstrated that this fundamental trust boundary can be dismantled purely through software. The exploit technique, designated "Download More RAM" (tracked under CVE-2026-23670), weaponizes unauthenticated Serial Presence Detect (SPD) chips on consumer Dual In-line Memory Modules (DIMMs) to create memory aliasing backdoors that bypass kernel and hypervisor access controls.

The Mechanism: Software-Driven Serial Presence Detect (SPD) Tampering

When a system boots, the UEFI firmware queries each installed RAM module via the Inter-Integrated Circuit ($\text{I}^2\text{C}$) or System Management Bus (SMBus) protocol. Specifically, it reads the Serial Presence Detect (SPD) non-volatile EEPROM chip on the DIMM to determine module timing, architecture, and total capacity.

Historically, hardware tampering with memory layouts required physical intervention (e.g., hardware interposers or chip desoldering). However, the researchers discovered that numerous commercial DDR4 and DDR5 memory modules ship with write-protection disabled on the SPD EEPROM by default.

Exploitation Chain

In-Band SMBus Writing: A local process with low-level device access executes write commands over the exposed SMBus/$\text{I}^2\text{C}$ bus directly into the memory module's SPD EEPROM. Capacity Spoofing: The payload rewrites the SPD geometry bytes, instructing the memory module to declare double its actual capacity (e.g., advertising a 16 GB physical module as a 32 GB module). Warm Reboot & Address Aliasing: Upon a software-initiated warm reboot, the UEFI memory training routines configure the CPU memory controller according to the forged SPD parameters. Hardware-Level Memory Mirroring: Because the physical memory lines do not exist beyond the true 16 GB boundary, upper address lines wrap around or decode back into lower physical addresses (address aliasing).

Bypassing Hypervisor and OS Memory Protections

Because the OS page tables and virtualization hypervisors believe the higher memory addresses exist as distinct physical pages, access control lists (ACLs), page permissions, and Isolated User Mode (IUM) boundaries configured for base addresses are not enforced on their aliased counterparts.

Arbitrary Kernel Write: An attacker writing to an unrestricted high physical memory address actually modifies lower physical pages where protected kernel code, page tables, or cryptographic secrets reside. Neutralizing Hypervisor Protections: Security defenses like HVCI rely on Second-Level Address Translation (SLAT) / Extended Page Tables (EPT) to prevent unauthorized code execution. Address aliasing circumvents SLAT mappings entirely at the memory controller bus level.

Mitigation and Defensive Engineering

The discovery highlights a critical gap between low-level bus security and high-level operating system threat models. Defensive measures require action at both the firmware and hardware layers:

What does this mean for your average person in the development field?

For the average person in the hardware software development field this helps set the paving stones for the future acting as a sort of guide through ever present traps and gotchas in the world of tech.

What does this mean for the average person?

This is a technical research paper and not something you are likely to find in the wild. However, with AI and trending chaos across the internet the probability is not 0. This doesn't mean your average person is in any more a danger than they were before they read this. This attack would generally call for a very specific setup where there is already significant control over the target. Its just a kind of low-level complex research that paves the way for hardware and software devs to help build a more fault resistant future.