Christopher Domas has done something unusual in the security world: he has built a tool that quietly reopens a door most of us assumed was welded shut. His open-source project, skitter-creek-bath-salts, manipulates the memory controller's translation registers to let unprivileged software reach protected memory regions. That is not a clever parlor trick. It is a direct challenge to the idea that CPU privilege boundaries are a stable foundation we can build on. For anyone working in cloud or confidential computing, this is the kind of finding that should make you pause mid-keystroke and reconsider what you are actually trusting.
Let us be clear about what this means in practical terms. The memory controller is not the CPU core, and that distinction is exactly why this matters. Most threat models focus on the processor's instruction set and its privilege rings, but Domas has shown that the translation logic sitting between the CPU and physical memory is a separate, attackable surface. When you rent a confidential computing instance or run a multi-tenant workload, you are relying on the processor to enforce isolation. This research suggests that the processor's own memory management is not the impenetrable wall it is marketed to be. The tool is open source, which is both a gift and a warning: it means defenders can study it, but it also means the barrier to entry for exploiting this class of vulnerability just dropped to anyone willing to read the code.
Our honest take is that this is not a reason to abandon the cloud, but it is a reason to demand more transparency from hardware vendors. The industry has spent years moving sensitive workloads into enclaves and trusted execution environments, often with the assumption that hardware isolation is a solved problem. Domas has demonstrated that the problem is not solved, and that the layer below the operating system deserves the same scrutiny we apply to application code. For our readers, the immediate takeaway is simple: do not treat hardware isolation as an implicit guarantee. Ask your provider how they handle memory controller firmware updates, and push for public research into these translation registers. The security community has been here before, with speculative execution, and the lesson was that architectural assumptions need constant re-examination.
The specific detail worth watching is how Intel and AMD respond. Domas's work targets a low-level register interface that has historically been opaque, and the fact that it is exposed to unprivileged software at all is the real story. If this forces a firmware revision or a documented microcode change, that is a win. If it is met with silence, that is a signal. We would tell any reader who asks: treat this as a starting point, not a conclusion. The next step is to see whether the industry treats memory controller registers as a first-class security boundary or as an internal detail that should have stayed hidden. That answer will shape how we build the next decade of secure systems.