The Patching Friars' AlmanacA calendar of CVE saints

December 10

BadRAMHoly card for badram, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 SPD 2× ? BadRAM MENTITUR DE MOLE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint BadRAM, Who Lied About Its Size

Patron of encrypted VM memory, SPD chips, and RAM modules that claim more than they have.

Life

On 10 December 2024 a team of researchers presented BadRAM: with a Raspberry Pi Pico, a DDR socket and a 9-volt battery, for around ten euros, they tampered with a module's SPD chip so it reported more capacity than it really had. The CPU then accessed 'ghost' addresses silently mapped onto real memory, bypassing AMD SEV-SNP protections and allowing the attestation of encrypted virtual machines to be forged.

Prayer

O Saint BadRAM, who inflates the modules' size to fool the CPU, let our memory declare only what it holds. Amen.

How to celebrate

Celebrated by installing the AMD firmware update and choosing modules that lock the SPD at the factory.

Whoever claims to be big is making room for a guest.

Technical record

Disclosed on
December 10 2024
CVE
CVE-2024-21944
CVSS
5.3
Product
AMD · AMD EPYC™ 7003 Series Processors

Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to potentially overwrite guest memory resulting in loss of guest data integrity.

Sources: badram.eu

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.