DDRop Attack Breaks Intel TDX and AMD SEV-SNP Memory Protection

Security researchers have disclosed a hardware attack called DDRop that breaks memory protection in Intel and AMD confidential computing by silently dropping writes to a server's memory, so the processor keeps reading old encrypted data as if it were current. The attack is the first active interposer attack to work on DDR5 memory in today's cloud servers, and the first to break the integrity of an up-to-date Intel TDX system rather than only read data from it. The method requires an attacker who already controls the server's software and can briefly access the machine to insert a small circuit board, called an interposer, between the processor and a memory module. The researchers say the interposer costs under $200 to build, can be fitted in minutes, and is then driven entirely from software. DDRop works against Intel TDX, Intel Scalable SGX, and AMD SEV-SNP, the hardware technologies that cloud services use to keep customer data private while it is in use, even from the cloud provider.

Confidential computing keeps a server's memory encrypted, so someone with physical access to the machine sees only scrambled data. To cover the large amount of memory a cloud server uses, however, these designs omit a guarantee called freshness. The processor can confirm that memory is encrypted, but not that it holds the latest written value, and old encrypted data still decrypts correctly. DDRop turns that gap into an attack. When the interposer drops a write, the earlier value stays in memory, and the processor reads it back as though the update had happened. The encryption engine detects nothing wrong.

The interposer is a small board of switches that sits on the memory bus and runs at full DDR5 speed. To drop a write, it forces an error on the command bus and then cuts the wire the memory module uses to report that error, so the module quietly discards the command and the processor is never told. Earlier DDR5 interposer attacks such as TEE.fail were passive: they listened to the memory bus and had to slow it down to work with second-hand lab equipment. Active attacks that changed what the memory saw, such as Battering RAM, worked only on older DDR4, because DDR5's redesigned command format blocks the address-swapping trick they used. DDRop gets around that by dropping writes instead.

On Intel TDX, the researchers turned write-dropping into full control of a protected virtual machine. TDX keeps each virtual machine's page tables encrypted and under the control of trusted firmware. When that firmware writes empty entries to set up a new page table, DDRop drops those writes, so the table instead keeps attacker-chosen data left in that memory beforehand. That lets an attacker's own virtual machine map its memory onto any physical address and read or change protected memory. With that access, the researchers read a victim virtual machine's private memory and switched a victim machine into debug mode, which let them copy its memory in plaintext and then restore the original data so the victim showed no sign of tampering. They also overwrote the launch measurement that a virtual machine uses to prove to a remote customer that it started in a known, trusted state. With that changed, a virtual machine the attacker controls could pass that check as if it were a trusted one.

Two of these results, reading a victim's memory and toggling debug mode, were shown only under TDX's default mode called logical integrity. TDX's optional stronger mode called cryptographic integrity would block them, the researchers say, because both involve changing data that belongs to another virtual machine. Forging a machine's own attestation, they argue, would still work under the stronger mode, because that write happens inside the attacker's own virtual machine and under its own key, so the hardware still marks the data as valid. Cryptographic integrity does not add a freshness check either, so it cannot tell that old contents were reused. Their test system did not support the mode, so they could not confirm this.

On AMD SEV-SNP, the result is narrower. Dropping writes during AMD's page-relocation feature let the researchers copy the contents of one victim page into another, but the debug-mode and attestation-forgery attacks are specific to Intel TDX. All three technologies encrypt memory without the freshness check DDRop exploits, so all three are affected. Intel's older Client SGX, used in some desktop and laptop chips, is not affected because it uses a hardware integrity tree that catches stale data, though Intel has since retired it. NVIDIA's confidential-computing GPUs are out of reach because their memory sits inside the chip package where an interposer cannot be fitted. The researchers did not test Arm's CCA and say it may be affected too.

The attack is aimed at cloud servers, not home computers or phones. Intel TDX, Scalable SGX, and AMD SEV-SNP are offered by major cloud platforms, including AWS, Microsoft Azure, and Google Cloud, to protect customer workloads. DDRop does not show that any of these services has been broken into. It shows that an attacker with the right access and a cheap piece of hardware could undermine the protection those services rely on. The researchers told The Hacker News they have no evidence of DDRop or a comparable active interposer being used outside a laboratory.

There is no simple patch. The weakness is in the hardware design, the researchers say. Today's scalable memory encryption gives up the freshness check in exchange for protecting large amounts of memory, and closing the gap for good would need new memory-encryption hardware that adds both integrity and freshness. Software changes can raise the bar without removing the root cause. These include restricting the memory-management features DDRop abuses, checking that important writes actually landed, and looking for an interposer during boot. Intel and AMD were informed about DDRop in advance through coordinated disclosure, and both acknowledged the findings and would issue security bulletins on the disclosure date. Neither company offered mitigation guidance or a timeline, the researchers said. AMD told The Hacker News that because the attack requires physical access to the system, it falls outside the scope of the published threat model for SEV/SNP. Intel takes the same position on physical attacks against server memory. Intel has separately said that physical interposer attacks of this kind fall outside the protection provided by its memory encryption, and that it does not plan to assign such attacks a CVE. It has also described this research area as out of scope, but not out of mind. Intel's optional cryptographic-integrity mode, available on some current Xeon processors, already blocks part of DDRop, and Intel says it is working on stronger memory-encryption designs for future chips. One of those proposals, called cache-line versioning, would add a freshness check to the memory bus. The researchers say it is u