Researchers have uncovered a new hardware attack known as DDRop, which compromises the memory protection in Intel and AMD confidential computing. This attack involves dropping writes to a server’s memory, causing the processor to continue reading outdated encrypted data as if it were current.
DDRop requires an attacker who already has control over the server’s software and can briefly access the machine to insert an interposer, a small circuit board, between the processor and a memory module.
The interposer, which costs less than $200 to build, targets Intel TDX, Intel Scalable SGX, and AMD SEV-SNP, the hardware used by cloud services to ensure the privacy of customer data even from the cloud provider.
Confidential computing aims to keep a server’s memory encrypted, preventing unauthorized access to sensitive data. However, these designs lack a freshness guarantee, allowing the processor to read old encrypted data without detecting any anomalies.
DDRop exploits this vulnerability by dropping writes, causing the processor to retrieve outdated data as if it were up-to-date. This attack is the first active interposer attack to impact DDR5 memory in current cloud servers, demonstrating its effectiveness against Intel TDX systems.
Prior interposer attacks on DDR5 memory were passive and required equipment to slow down the memory bus. DDRop, on the other hand, operates at full DDR5 speed, dropping writes to manipulate the data read by the processor.
The researchers behind DDRop, from KU Leuven, ETH Zurich, Durham University, and Google, are set to present their findings at the ACM CCS 2026 conference. They plan to release the interposer board designs, controller firmware, and attack code on GitHub.
Impact on Intel TDX
On Intel TDX, DDRop enables attackers to gain full control of a protected virtual machine by manipulating page tables encrypted under trusted firmware. By dropping writes, attackers can substitute attacker-chosen data into the page tables, allowing unauthorized access to protected memory.
While DDRop showcases the vulnerability of Intel TDX, the attack’s effects are more limited on AMD SEV-SNP, focusing on page-relocation features rather than full control over virtual machines.
All three technologies targeted by DDRop lack a freshness check in their memory encryption, making them susceptible to this type of attack. Intel’s older Client SGX, which incorporates a hardware integrity tree, remains unaffected by DDRop.
Cloud servers utilizing Intel TDX, Scalable SGX, and AMD SEV-SNP for confidential computing are at risk of DDRop attacks. While there is no evidence of DDRop being exploited outside of controlled environments, the potential impact on cloud security is significant.
Addressing the Vulnerability
Addressing the hardware design flaw exploited by DDRop poses a significant challenge. While software changes can enhance security measures, a comprehensive solution would require new memory-encryption hardware with integrity and freshness checks.
Intel and AMD were notified of DDRop in advance and plan to issue security bulletins addressing the vulnerability. However, mitigating the risk posed by DDRop may necessitate fundamental changes in memory encryption technology.
As the cybersecurity landscape evolves, researchers continue to explore innovative attack vectors like DDRop, underscoring the importance of proactive security measures to safeguard sensitive data.
