DDRop: A Cheap Interposer Breaks Intel TDX and AMD SEV-SNP

The confidential-computing technologies Intel TDX, Scalable SGX and AMD SEV-SNP encrypt a server's memory so that even the cloud provider sees nothing but a meaningless jumble of data. To cover the enormous amounts of memory involved, however, these schemes give up the guarantee of “freshness”: the processor can confirm that the data is encrypted, but it cannot verify that what it is looking at is the most recently written version. Stale encrypted data is decrypted as if nothing were amiss.

The DDRop attack, presented by researchers from KU Leuven, ETH Zürich, Durham University and Google, turns this gap into a weapon. A small interposer board costing around $159 is inserted between the processor and the memory module. It can silently drop write operations: the interposer triggers an error on the command bus and then cuts the wire over which the module would have reported it — the command is quietly ignored, and the processor never learns about it. The old value remains in memory and is read as though it were current.

Why this is new

DDRop is the first active attack of its kind to work on the DDR5 memory of today's cloud servers, and the first to break the integrity of a current Intel TDX system rather than merely reading data out of it. Earlier attacks on DDR5 (such as TEE.fail) were passive and only eavesdropped on the bus, while the active Battering RAM worked only on the older DDR4. Dropping writes bypasses the protections of DDR5's new command format.

What they pulled off

On Intel TDX the researchers gained full control over a protected virtual machine. By dropping the writes that clear page-table entries, they slipped in previously prepared data, which let them map their own memory to any physical address. This allowed them to read the private memory of another VM, put it into debug mode and copy its contents in the clear, then restore the original state without leaving a trace. On top of that, they forged the launch measurement that a VM uses to prove to a client that it started in a trusted state.

On AMD SEV-SNP the result was more modest: the attack only made it possible to copy the contents of one of the victim's pages into another.

The vendors' response

There is no simple patch — the vulnerability is baked into the hardware architecture. Intel and AMD were notified in advance, but both companies place attacks that require physical access outside their threat model. Intel said it does not plan to assign CVEs to such attacks, calling the whole area “out of scope, but not out of sight,” and is working on new memory-encryption schemes.

The attack targets cloud servers, not home computers. The researchers stress that they have no evidence of DDRop being used outside the lab, but a single brief visit to a machine is enough — and such access could be arranged by a rogue data-center employee, a supply-chain compromise or a legal seizure of the equipment. The team promises to publish the boards, firmware and attack code on GitHub in time for the ACM CCS 2026 conference in November.

Source: The Hacker News