Researchers Bypass Windows 11 VBS & HVCI via Software‑Only DIMM SPD Manipulation
What Happened — Researchers from the University of Birmingham and Durham University demonstrated a software‑only attack, dubbed “Download More RAM,” that rewrites the Serial Presence Detect (SPD) data on certain DIMM modules. By falsifying the memory‑size information, the exploit creates alias memory that lets a privileged attacker bypass Windows 11’s strongest protections, including Virtualisation‑Based Security (VBS) and Hypervisor‑Enforced Code Integrity (HVCI).
Why It Matters for Compliance & Audit Readiness
- The technique assumes the attacker already has privileged access, exposing gaps in SOC 2 CC6.1/CC6.2 (least‑privilege and privileged‑account monitoring).
- Bypassing VBS/HVCI can disable EDR, re‑enable blocked drivers, and break isolation guarantees—exactly the control failures SOC 2 audits require continuous evidence for.
- Verisq’s SOC2 Access Controls capability helps you capture immutable logs of privileged‑account activity and hardware‑configuration changes, providing audit‑ready proof that such bypass attempts are detected and blocked.
Who Is Affected
- Enterprises that deploy Windows 11 on standard consumer‑grade RAM (most sectors).
- Organizations subject to SOC 2 compliance, especially those handling regulated data (finance, health, SaaS).
Recommended Actions
- Review and tighten privileged‑account policies; enforce least‑privilege and MFA for any admin access.
- Deploy continuous monitoring of firmware/BIOS/SPD changes and integrate alerts into your SOC 2 evidence collection pipeline.
- Verify that all DIMM modules in use are from vendors that enforce read‑only SPD or have firmware patches; replace vulnerable modules where possible.
- Update Windows 11 with any forthcoming Microsoft guidance and document the remediation steps for audit purposes.
Source: Help Net Security
Technical Notes
- Attack vector: software‑only SPD overwrite on Dual‑In‑Line Memory Modules (DIMMs).
- No CVE assigned yet; the research paper details the exploit methodology and impact on VBS, HVCI, and kernel‑level anti‑cheat mechanisms.
- Affected data: any data protected by VBS/HVCI, including credential stores, encryption keys, and isolated workloads.
Source: Research paper (PDF)