New DDRop Attack Compromises Intel and AMD Confidential Computing
Researchers reveal a hardware attack that undermines memory protection in cloud servers.
1Introduction to DDRop Attack
Researchers have uncovered a new hardware attack named DDRop, which bypasses memory protection in Intel TDX and AMD SEV-SNP confidential computing technologies. By silently dropping memory writes, the attack tricks processors into reading outdated encrypted data as current. This vulnerability affects major cloud services that rely on these technologies to protect customer data. The attack requires physical access to insert a sub-$200 interposer between the processor and memory module.
2How DDRop Works
DDRop exploits a gap in memory encryption by dropping write commands, leaving old data in place. The interposer forces an error on the command bus and silences the memory module's error report, making the processor unaware of the dropped write. This attack is the first to break the integrity of Intel TDX systems and works on DDR5 memory, unlike previous attacks limited to DDR4. The interposer operates at full DDR5 speed, making it highly effective.
3Impact on Intel TDX
On Intel TDX, DDRop allows full control of a protected virtual machine. By dropping writes during page table setup, attackers can replace entries with pre-existing malicious data. This enables mapping attacker-controlled memory onto any physical address, reading or altering protected memory. Researchers demonstrated reading private memory and toggling debug mode, though cryptographic integrity mode could block some exploits. Forging attestations remains possible even in stronger modes.
4Impact on AMD SEV-SNP
AMD SEV-SNP is less severely affected, with write-dropping limited to copying victim page contents during relocation. Debug-mode and attestation-forgery attacks are Intel TDX-specific. However, all three technologies (Intel TDX, Scalable SGX, AMD SEV-SNP) lack freshness checks, making them vulnerable. NVIDIA's GPUs and Arm's CCA were not tested but may also be at risk, with NVIDIA's design currently immune due to on-package memory.
5Technical Details of the Interposer
The interposer is a small circuit board with switches that sits on the memory bus. It costs under $200 to build and runs at full DDR5 speed. Unlike passive attacks like TEE.fail, DDRop actively modifies memory commands. It avoids DDR5's command format protections by dropping writes instead of swapping addresses. The researchers will release interposer designs, firmware, and attack code on GitHub alongside their ACM CCS 2026 conference paper.
6Limitations and Scope
DDRop targets cloud servers, not consumer devices, and requires physical access to install the interposer. Major cloud platforms like AWS, Azure, and Google Cloud use affected technologies. There's no evidence of real-world exploitation yet. The attack highlights a hardware design flaw: scalable memory encryption sacrifices freshness checks for large memory protection. Software mitigations can raise barriers but won't eliminate the root issue.
7Potential Mitigations
No simple patch exists, as the flaw is hardware-based. Future memory-encryption hardware must integrate both integrity and freshness checks. Current software fixes can restrict memory access patterns or add redundancy to critical operations, raising the attack's complexity. Cryptographic integrity modes (like Intel TDX's optional setting) can block some exploits but not attestation forgery, which uses valid keys.
8Broader Implications
DDRop underscores the trade-offs in confidential computing: scalability versus security. Cloud providers must reassess physical security for high-risk workloads. The attack also pressures chipmakers to redesign memory encryption. While not an immediate threat, DDRop sets a precedent for low-cost, high-impact hardware attacks, urging faster adoption of robust protections in next-gen architectures.