New “Download More RAM” Attack Breaks Windows VBS and Disables EDR Protections
Brief
A newly disclosed Windows attack technique dubbed “Download More RAM” can undermine Virtualization-Based Security (VBS) , bypass Hypervisor-Protected Code Integrity (HVCI), and disable endpoint defenses including Microsoft Defender and third-party EDR products.
Documented by USENIX, the attack does not exploit a conventional Windows kernel vulnerability. Instead, it targets an overlooked weakness in certain consumer DDR4 and DDR5 memory modules: writable Serial Presence Detect (SPD) configuration data.
SPD data tells a system’s firmware how much memory is installed and how it is organized. If the SPD EEPROM is insufficiently write-protected, an attacker with local administrator privileges can alter the reported geometry of a DIMM, causing the system to believe that more RAM is present than is physically present.