What's this about?
Christopher Domas — the reverse engineer known for the MoVfuscator and for finding hidden instructions in x86 processors — published a software-reachable memory-aliasing attack against AMD 16h processors. By abusing undocumented DRAM controller address swizzling, code running as ring-0 root can reach regions of the system normally hidden below it, in what people informally call "negative ring" territory. The thread's energy came as much from the researcher's return as from the finding.
What exactly is a "negative ring"?
Processors enforce privilege in rings: your applications run in ring 3, the operating system kernel in ring 0. Modern hardware adds layers *beneath* ring 0 — hypervisors, and below them firmware and management processors that boot before the OS and can see everything, which people nickname ring -1, -2 and -3. These are supposed to be unreachable from the OS by design. An attack that lets ring-0 code reach into that territory breaks the assumption underpinning virtual machine isolation and secure boot alike.
What's the community saying?
- The unresolved questions are the important ones. Can it break out of KVM? Can it be fixed with a microcode patch? Which processor families beyond this older low-power AMD line are affected? The writeup is quiet on all three.
- Comparison to hardware-level attacks. The top comment framed it as a software-reachable version of the dynamic memory aliasing attack demonstrated by BatteringRAM — meaning something previously requiring physical hardware access may now be reachable in software.
- Genuine excitement about the author. Multiple long-time followers described watching his DEFCON talks on x86 shenanigans, noted he was hired by Intel, and expressed real anticipation for the accompanying Black Hat talk.
- An unexpected complaint about AI writing. A recurring, well-received grievance: his READMEs used to be a joy to read and are now visibly LLM-written, and the "Claudeisms" have made them worse. A rare case of a community objecting to AI prose in security research specifically because the author's voice was the value.
- "Opus refuses to discuss this at all." A short comment that drew attention — a model declining to engage with published security research, offered without further interpretation.