DDRop hardware attack targets Intel TDX and AMD SEV-SNP
Researchers at KU Leuven, ETH Zurich, Durham University and Google have disclosed DDRop, a hardware attack that undermines memory protection in Intel TDX, Intel Scalable SGX and AMD SEV-SNP confidential-computing technologies. The attack uses a small interposer placed between a processor and DDR5 memory module; its parts cost was estimated at about $159, excluding development and labour.
DDRop requires an attacker to control software on the server and gain brief physical access to install the device. It does not demonstrate a compromise of AWS, Microsoft Azure or Google Cloud, although those platforms offer these technologies for protecting customer workloads. The researchers said they have no evidence that DDRop or a similar active interposer has been used outside a laboratory.
Dropping writes rather than breaking encryption
Confidential computing encrypts memory so that data remains unreadable to someone with physical access to a server. At cloud-server scale, however, the designs discussed by the researchers do not provide freshness: the processor can verify encryption but cannot establish that a memory value is the most recently written one.
DDrop exploits that limitation by making a memory module discard a write while concealing the resulting error from the processor. The interposer forces an error on the DDR5 command bus, then interrupts the module's error report. Older encrypted contents remain in memory and are accepted when read back, because they still decrypt correctly.
The team describes DDRop as the first active interposer attack for DDR5 memory in current cloud servers and the first to break integrity on an up-to-date Intel TDX system. Passive DDR5 attacks such as TEE.fail listened to the memory bus, while earlier active techniques such as Battering RAM relied on DDR4 address swapping that DDR5's command format prevents.
Different consequences for Intel and AMD systems
On Intel TDX, the researchers used dropped writes while trusted firmware created page-table entries. By preserving attacker-chosen data in those locations, an attacker-controlled virtual machine could map memory to arbitrary physical addresses. The team then read a victim virtual machine's private memory, enabled debug mode to copy memory in plaintext, and restored data so that tampering was not apparent.
They also changed a launch measurement used for remote attestation, allowing an attacker-controlled virtual machine to pass a trust check as if it had started in an approved state. Reading victim memory and switching debug mode were demonstrated under TDX logical integrity. Intel's optional cryptographic-integrity mode would block those two demonstrations, the researchers said, but their test system did not support that mode.
For AMD SEV-SNP, the demonstrated result was narrower: write drops during page relocation allowed contents from one victim page to be copied to another. Intel Client SGX is not affected because it uses a hardware integrity tree, while NVIDIA confidential-computing GPUs are outside the attack's physical reach because their memory is contained within the chip package. The researchers did not test Arm CCA.
Mitigation depends on hardware and physical security
The researchers said there is no simple patch because the issue stems from a hardware trade-off in scalable memory encryption. Software measures may constrain memory-management features, verify that important writes landed, or check for an interposer at boot, but they do not remove the missing freshness guarantee.
Intel and AMD received the findings through coordinated disclosure. Both regard physical attacks on server memory as outside their published threat models; Intel also said its cryptographic-integrity option blocks part of the attack and is developing stronger future memory-encryption designs. For businesses using confidential computing, the practical implication is to assess physical data-centre access, supply-chain tampering exposure and the integrity settings available on the specific server platforms running sensitive workloads.