DDRop Attack Breaks Memory Protection in Intel and AMD Confidential Computing
Researchers have disclosed a new hardware attack called DDRop that can undermine memory protection in Intel and AMD confidential-computing technologies.
The attack works by silently dropping write operations to a server's memory. As a result, the processor may continue reading older encrypted data as though it were the latest value.
DDRop affects Intel TDX, Intel Scalable SGX, and AMD SEV-SNP, technologies used by cloud providers to protect customer workloads while they are running.
Attack Requires Physical Access to the Server
To carry out DDRop, an attacker must already control the server's software and briefly gain physical access to the machine.
The attacker then installs a small circuit board called an interposer between the processor and a memory module.
According to the researchers:
- The interposer costs approximately $159 in parts.
- The device can be installed within minutes.
- It operates at full DDR5 memory speed.
- The attack can be controlled through software after installation.
The hardware could potentially be placed by a malicious data-center employee, through supply-chain tampering, or after a machine is obtained under legal authority.
DDRop Exploits the Lack of Memory Freshness Checks
Confidential-computing technologies encrypt server memory so that even someone with physical access cannot easily read the stored information.
However, large-scale memory encryption systems may not verify whether the data being read is the newest version. This protection is known as freshness.
The processor can verify that data is encrypted correctly, but it may not be able to determine whether an older encrypted value has been reused.
DDRop exploits this limitation.
When the interposer blocks a write operation, the previous value remains in memory. The processor later reads the old value and treats it as though the requested update had been completed.
Because the old data is still correctly encrypted, the memory-encryption engine does not detect the manipulation.
How the DDR5 Interposer Works
The DDRop interposer uses switches placed on the memory bus.
To drop a write operation, the device:
- Forces an error on the memory command bus.
- Prevents the memory module from reporting that error to the processor.
- Causes the memory module to silently discard the write.
- Leaves the previous data in memory.
This approach allows DDRop to work with modern DDR5 memory.
Earlier attacks, such as TEE.fail, mainly monitored memory traffic and were passive. Other active attacks, including Battering RAM, targeted older DDR4 memory and relied on address-swapping techniques that do not work with DDR5's redesigned command format.
DDRop avoids those limitations by dropping writes instead of changing memory addresses.
DDRop Attacks Intel TDX
On Intel TDX, researchers used DDRop to gain control over protected virtual-machine memory.
TDX protects virtual machines by encrypting their page tables and placing them under the control of trusted firmware.
During the creation of a new page table, the firmware writes empty entries. DDRop can block those writes, allowing attacker-controlled data that was already present in memory to remain in place.
This could allow an attacker's virtual machine to:
- Map its memory to arbitrary physical addresses.
- Read protected memory belonging to another virtual machine.
- Modify protected memory.
- Access private data from a victim virtual machine.
- Switch a victim virtual machine into debug mode.
- Copy memory in plaintext and restore the original data afterward.
- Modify launch measurements used for remote attestation.
Changing the launch measurement could allow an attacker-controlled virtual machine to appear as though it had started in a trusted state.
Stronger TDX Mode Blocks Some Attacks
The researchers tested some attacks against TDX's default logical integrity mode.
They said that TDX's optional cryptographic integrity mode would block attacks involving changes to data belonging to another virtual machine.
However, the researchers believe that attestation forgery could still be possible under the stronger mode. In that case, the manipulated data belongs to the attacker's own virtual machine and is protected by its own key.
The researchers could not confirm this result because their test system did not support cryptographic integrity mode.
They also noted that cryptographic integrity does not add a freshness check, meaning it may not detect the reuse of older valid data.
Impact on AMD SEV-SNP
On AMD SEV-SNP, researchers used DDRop during AMD's page-relocation process to copy the contents of one victim page into another.
However, the debug-mode and attestation-forgery techniques demonstrated against Intel TDX do not directly apply to AMD SEV-SNP.
All three affected technologies use memory encryption without the freshness protection exploited by DDRop.
Intel's older Client SGX technology is not affected because it uses a hardware integrity tree that can detect stale data. Intel has since retired Client SGX.
Other Technologies
NVIDIA confidential-computing GPUs are not affected by this specific attack because their memory is located inside the chip package, leaving no practical place to install an interposer.
The researchers did not test Arm's Confidential Compute Architecture and said it may also be affected.
DDRop is primarily a threat to cloud servers rather than ordinary home computers or smartphones.
Intel TDX, Intel Scalable SGX, and AMD SEV-SNP are used by major cloud platforms, including Amazon Web Services, Microsoft Azure, and Google Cloud. However, the research does not show that any of these cloud providers has been breached.
Instead, it demonstrates that an attacker with sufficient software control, brief physical access, and a low-cost hardware device could undermine the memory protections used by confidential-computing systems.
The researchers said they have no evidence that DDRop or a similar active interposer attack has been used outside laboratory conditions.
No Simple Software Patch Available
The researchers said there is no simple patch because the weakness is connected to the underlying hardware design.
Modern memory-encryption systems sacrifice freshness checks to protect large amounts of memory efficiently. Fully addressing the problem would require new memory-encryption hardware that provides both integrity and freshness verification.
Software and platform-level changes could still make exploitation more difficult. Possible measures include:
- Restricting memory-management features abused by DDRop.
- Verifying that important memory writes were completed successfully.
- Checking for unauthorized interposers during system boot.
- Improving physical security around servers and memory modules.
Intel and AMD were informed of the findings through coordinated disclosure. The researchers said both companies acknowledged the research and planned to publish security bulletins.
AMD stated that the attack requires physical access and therefore falls outside the published threat model for SEV-SNP. Intel has taken a similar position regarding physical attacks against server memory.
Intel also stated that physical interposer attacks are outside the protection provided by its memory-encryption technologies and said it does not plan to assign such attacks a CVE.
Intel's optional cryptographic-integrity mode already blocks some DDRop techniques, and the company is working on stronger memory-encryption designs for future processors.
Researchers Release Attack Materials
DDRop was developed by researchers from KU Leuven, ETH Zurich, Durham University, and Google.
The research is scheduled to be presented at the ACM CCS 2026 conference in November.
The team plans to release:
- Interposer board designs.
- Controller firmware.
- Attack code.
- The complete research paper.
