A novel exploit dubbed “Download More RAM” circumvents Windows Virtualization-Based Security (VBS), undermines Hypervisor-Enforced Code Integrity (HVCI), and disables Microsoft Defender. The attack exploits improperly secured Serial Presence Detect (SPD) data on specific consumer DDR4 and DDR5 memory modules. If the SPD chip allows for modification, an attacker with local administrator privileges can alter the reported memory specifications, making the system believe a RAM module has more capacity than it actually contains.
This results in a memory aliasing issue where Windows treats two separate physical addresses as distinct locations but actually point to the same underlying RAM. In contrast, the Download More RAM attack exploits raw physical memory by circumventing protections based on page tables, process permissions, and virtual trust levels.
Researchers uncovered that attackers could read aliased memory through a modified forensic memory acquisition tool and then write limited data to selected memory regions using a RAM-disk utility. The patches disabled checks designed to block known vulnerable drivers. Stage 6 Driver-Based Attacks Load blocked drivers to access physical memory, enabling modification of protected memory areas, including those associated with VBS-protected processes and endpoint security products.
Organizations should apply current Windows updates, maintain Secure Boot and VBS protections, review BIOS settings for SPD write restrictions, and consider enforcing SPD write protection on configuration blocks defining module capacity and addressing.
