DDRop Attack Undermines Intel TDX and AMD SEV-SNP Memory Protection, Researchers Say

Researchers have disclosed a hardware attack called DDRop that breaks memory protection in Intel and AMD confidential computing by silently dropping writes to a server's memory, causing the processor to keep reading old encrypted data as if it were current.

The attack requires an attacker who already controls the server's software and can briefly access the machine to insert an interposer - a small circuit board - between the processor and a memory module. The interposer costs under $200 to build. DDRop works against Intel TDX, Intel Scalable SGX, and AMD SEV-SNP, the hardware cloud services use to keep customer data private while in use, even from the cloud provider.

Confidential computing keeps server memory encrypted, but these designs omit a guarantee called freshness. The processor can confirm memory is encrypted, but not that it holds the latest written value. DDRop turns that gap into an attack: when the interposer drops a write, the earlier value stays in memory and the processor reads it back as though the update happened.

The researchers say DDRop is the first active interposer attack to work on DDR5 memory in today's cloud servers, and the first to break the integrity of an up-to-date Intel TDX system rather than only read data from it. Earlier DDR5 interposer attacks such as TEE.fail were passive, while active attacks like Battering RAM worked only on older DDR4.

On Intel TDX, the researchers turned write-dropping into full control of a protected virtual machine, reading a victim's private memory and switching a victim machine into debug mode. They also overwrote the launch measurement a virtual machine uses to prove to a remote customer that it started in a trusted state. Two of these results were shown only under TDX's default logical integrity mode; the stronger cryptographic integrity mode would block them, the researchers say, though attestation forgery would still work because the write happens inside the attacker's own virtual machine. Their test system did not support that mode, so they could not confirm it.

On AMD SEV-SNP, the result is narrower: dropping writes during AMD's page-relocation feature let the researchers copy one victim page's contents into another. All three technologies encrypt memory without the freshness check DDRop exploits, so all three are affected. Intel's older Client SGX is not, because it uses a hardware integrity tree that catches stale data, though Intel has retired it. NVIDIA's confidential-computing GPUs are out of reach because their memory sits inside the chip package. The researchers did not test Arm's CCA and say it may be affected too.

The attack targets cloud servers, not home computers or phones. Intel TDX, Scalable SGX, and AMD SEV-SNP are offered by major cloud platforms including AWS, Microsoft Azure, and Google Cloud. DDRop does not show any of these services has been broken into. The researchers told The Hacker News they have no evidence of DDRop or a comparable active interposer being used outside a laboratory.

There is no simple patch. The weakness is in the hardware design, the researchers say, and closing the gap would need new memory-encryption hardware adding both integrity and freshness. Software changes can raise the bar without removing the root cause, such as restricting the memory-management features DDRop abuses, checking that important writes landed, and looking for an interposer during boot.

Intel and AMD were informed in advance through coordinated disclosure and acknowledged the findings. AMD told The Hacker News the attack requires physical access, falling outside the published threat model for SEV/SNP, and said its bulletin is due on its product security page later on September 14. Intel takes the same position on physical attacks against server memory, has said it does not plan to assign such attacks a CVE, and has described the research area as "out of scope, but not out of mind." Its optional cryptographic-integrity mode blocks part of DDRop, and Intel says it is working on stronger memory-encryption designs for future chips, including a proposal called cache-line versioning whose effect on DDRop is unclear.

DDRop is the work of researchers at KU Leuven, ETH Zurich, Durham University, and Google, and is due to be presented at the ACM CCS 2026 conference in November. The team says it is releasing the interposer's board designs, controller firmware, and attack code on GitHub alongside their research paper. The researchers put the parts for one interposer at about $159, not counting development or labor, and say it can be fitted in minutes and driven entirely from software. Because it needs only one brief visit to the machine, they say the access could come from a rogue data-center employee, tampering in the supply chain, or hardware seized under legal compulsion.

Source: The Hackers News