BadRAM Attack Breaches AMD Secure VMs with $10 Device

Researchers have uncovered a vulnerability that allows attackers to compromise AMD’s Secure Encrypted Virtualization (SEV) technology using a $10 device.

This breakthrough exposes a previously underexplored weakness in memory module security, specifically in cloud computing environments where SEV is widely used to protect sensitive data, which is shared on the BadRAM page.

Modern computers depend on DRAM (dynamic random-access memory) to store code and data, while processors perform computations.

The initial communication between a computer and its DRAM modules determines memory size, speed, and configuration.

However, what happens if a DRAM module deliberately deceives the processor? This study marks the first comprehensive examination of “bad RAM” — rogue memory modules that intentionally provide false data during startup, revealing a new vulnerability in processor security.

2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide

BadRAM Attack Breaches AMD

Cloud computing has increasingly relied on encryption to safeguard data, particularly in environments where data breaches and insider threats are prevalent.

AMD’s Secure Encrypted Virtualization (SEV) is designed to protect virtual machines (VMs) by encrypting their memory and ensuring isolation even from sophisticated attackers.

However, the research highlights a critical vulnerability where tampering with the embedded Serial Presence Detect (SPD) chip on commercial DRAM modules allows attackers to circumvent SEV protections, including AMD’s advanced SEV-Secure Nested Paging (SEV-SNP) version.

Using off-the-shelf equipment costing less than $10, attackers can deceive the processor into accessing unauthorized encrypted memory.

The BadRAM attack not only compromises the security of AMD SEV but also enables the manipulation of remote attestation reports and the insertion of backdoors into any SEV-protected VM.

In response, AMD has released firmware updates aimed at securely validating memory configurations during the processor’s boot process to mitigate this threat.

In a demonstration, researchers showcased how the BadRAM primitive enables attackers to capture the contents of a memory location in a SEV-SNP VM and replay it, forming the basis for more sophisticated attacks.

This incident underscores the need for heightened vigilance and rapid adaptation in defending against emerging cybersecurity threats.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free