Cyber Security News

BadRAM Attack Breaches AMD Secure VMs with $10 Device

Researchers have uncovered a vulnerability that allows attackers to compromise AMD’s Secure Encrypted Virtualization (SEV) technology using a $10 device.

This breakthrough exposes a previously underexplored weakness in memory module security, specifically in cloud computing environments where SEV is widely used to protect sensitive data, which is shared on the BadRAM page.

Modern computers depend on DRAM (dynamic random-access memory) to store code and data, while processors perform computations.

The initial communication between a computer and its DRAM modules determines memory size, speed, and configuration.

However, what happens if a DRAM module deliberately deceives the processor? This study marks the first comprehensive examination of “bad RAM” — rogue memory modules that intentionally provide false data during startup, revealing a new vulnerability in processor security.

2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide

BadRAM Attack Breaches AMD

Cloud computing has increasingly relied on encryption to safeguard data, particularly in environments where data breaches and insider threats are prevalent.

AMD’s Secure Encrypted Virtualization (SEV) is designed to protect virtual machines (VMs) by encrypting their memory and ensuring isolation even from sophisticated attackers.

However, the research highlights a critical vulnerability where tampering with the embedded Serial Presence Detect (SPD) chip on commercial DRAM modules allows attackers to circumvent SEV protections, including AMD’s advanced SEV-Secure Nested Paging (SEV-SNP) version.

Using off-the-shelf equipment costing less than $10, attackers can deceive the processor into accessing unauthorized encrypted memory.

The BadRAM attack not only compromises the security of AMD SEV but also enables the manipulation of remote attestation reports and the insertion of backdoors into any SEV-protected VM.

In response, AMD has released firmware updates aimed at securely validating memory configurations during the processor’s boot process to mitigate this threat.

In a demonstration, researchers showcased how the BadRAM primitive enables attackers to capture the contents of a memory location in a SEV-SNP VM and replay it, forming the basis for more sophisticated attacks.

This incident underscores the need for heightened vigilance and rapid adaptation in defending against emerging cybersecurity threats.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Microsoft Patch Tuesday May 2025 Released With the Fixes for 72 Flaws With 5 Actively Exploited 0-Day

Microsoft has released its May 2025 Patch Tuesday updates, addressing 72 security vulnerabilities across its…

4 hours ago

Ivanti Released Security Updates to Fix for the Mutiple RCE Vulnerabilities – Patch Now

Ivanti, a leading enterprise software provider, has released critical security updates addressing vulnerabilities across several…

5 hours ago

Fortinet FortiVoice Zero-day Vulnerability Actively Exploited in The Wild

A critical stack-based buffer overflow vulnerability (CWE-121) has been discovered in multiple Fortinet products, including…

6 hours ago

Ransomware Attacks Surge by 123% Amid Evolving Tactics and Strategies

The 2025 Third-Party Breach Report from Black Kite highlights a staggering 123% surge in ransomware…

6 hours ago

Researchers Introduce Mythic Framework Agent to Enhance Pentesting Tool Performance

Penetration testing is still essential for upholding strong security procedures in a time when cybersecurity…

6 hours ago

Swan Vector APT Targets Organizations with Malicious LNK and DLL Implants

A newly identified advanced persistent threat (APT) campaign, dubbed "Swan Vector" by Seqrite Labs, has…

7 hours ago