DDRop hardware attack breaks confidential computing memory protection on Intel and AMD servers

A newly disclosed hardware-based security vulnerability, dubbed DDRop, has exposed a critical architectural weakness in modern confidential computing environments. By utilizing a low-cost, custom-built circuit board known as an interposer, researchers have demonstrated the ability to circumvent the memory encryption protections inherent in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP. The attack effectively silences write operations to a server’s memory, forcing the processor to rely on stale, encrypted data. This maneuver allows an adversary with brief physical access to a machine to manipulate protected virtual machines, potentially compromising the integrity of data that cloud providers and customers assumed was secure even from unauthorized administrative access.

The research, a collaborative effort between scholars at KU Leuven, ETH Zurich, Durham University, and Google, is slated for formal presentation at the ACM Conference on Computer and Communications Security (CCS) 2026. This discovery marks a significant milestone in hardware security research, as it represents the first successful active interposer attack capable of operating at the high speeds required by modern DDR5 memory modules.

Understanding the Mechanics of the DDRop Attack

The core of the DDRop attack lies in the fundamental design trade-offs made by semiconductor manufacturers to achieve high-performance confidential computing. While these technologies—Intel’s Trust Domain Extensions (TDX) and AMD’s Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP)—provide robust encryption for data in use, they generally omit a "freshness" guarantee. In cryptographic terms, this means that while the processor can verify that data retrieved from memory is encrypted and authentic, it cannot inherently determine whether the retrieved value is the most recent version written by the system.

DDRop exploits this gap by deploying an interposer—a small, inexpensive hardware device costing approximately $159 to assemble—directly onto the memory bus between the CPU and the memory module. When the system initiates a write command, the interposer intervenes. It forces an error on the command bus while simultaneously severing the physical connection the memory module uses to report that error to the processor. Consequently, the memory module silently discards the new data, while the processor remains under the impression that the write operation was successful. Because the existing, older encrypted data remains in the memory, the CPU continues to decrypt and utilize it, oblivious to the fact that the underlying state of the system has been manipulated.

Evolution of Interposer-Based Attacks

The development of DDRop follows a series of previous, less sophisticated attempts to undermine hardware-based memory security. Earlier research, such as the TEE.fail exploit, relied on passive monitoring of the memory bus. These attacks required significant performance degradation—slowing the memory bus to accommodate lab-grade equipment—to eavesdrop on memory traffic.

Other active attempts, such as the Battering RAM attack, focused on address-swapping to bypass protections. However, these methods were largely restricted to older DDR4 memory architectures. The transition to DDR5 introduced a redesigned command format that effectively rendered those previous techniques obsolete. DDRop represents a technological leap forward, as it is engineered to run at the full native speeds of DDR5 memory, making it the first active interposer attack to bypass the integrity protections of contemporary cloud server infrastructure.

Implications for Intel TDX and AMD SEV-SNP

The security implications of DDRop vary depending on the specific implementation of the confidential computing architecture. On systems running Intel TDX, the researchers were able to demonstrate a complete compromise of protected virtual machines. By dropping write operations during the initialization of new page tables, the attackers could ensure that the system utilized pre-loaded, malicious data. This allowed them to map their own virtual machine memory onto arbitrary physical addresses, effectively granting them read and write access to a victim’s private memory.

In laboratory tests, the research team successfully read a victim virtual machine’s private memory and toggled the system into a debug mode. This transition allowed them to exfiltrate data in plaintext. Furthermore, the attackers were able to overwrite the "launch measurement"—a cryptographic value used by remote customers to verify that their virtual machine booted in a trusted state. By forging this measurement, the attackers could make a malicious virtual machine appear as though it were a legitimate, secure instance.

The impact on AMD SEV-SNP appears more limited in scope, focusing primarily on the manipulation of page-relocation features to facilitate the copying of memory pages between virtual machines. While the debug-mode and attestation-forgery exploits were found to be specific to the Intel architecture, the root cause—the lack of a freshness check in encrypted memory—remains a shared vulnerability across all three platforms.

Official Responses and the Security Disclosure Timeline

The researchers initiated a coordinated disclosure process with both Intel and AMD well in advance of the public announcement. Despite the implications of the research, both semiconductor giants have maintained that the attack falls outside their established threat models.

Intel, in its formal response, reiterated that its memory encryption frameworks are designed to protect against unauthorized software access and certain types of data leakage, but are not intended to defend against attackers with physical access to the internal server hardware. Intel has indicated that it does not plan to assign a Common Vulnerabilities and Exposures (CVE) identifier to the research, categorizing it as "out of scope." However, the company noted that it is actively exploring "cache-line versioning" and other hardware-level solutions to incorporate freshness checks into future processor generations.

AMD similarly emphasized that physical interposer attacks, which require invasive hardware modification, fall outside the scope of the published threat model for its SEV and SNP technologies. The company has maintained its commitment to security through ongoing updates to its product security bulletins, though no specific software-based patch is currently available to mitigate the hardware-level design choice that enables DDRop.

Broader Industry Impact and Future Outlook

The existence of DDRop highlights a critical reality for data centers: the transition to confidential computing is an ongoing process that involves balancing performance, cost, and absolute security. The current generation of servers sacrifices the freshness guarantee to allow for the encryption of massive amounts of memory without incurring the severe performance penalties that would be associated with a full, hardware-level integrity tree.

While there is no simple software patch for this vulnerability, the researchers suggest that providers can raise the barrier to entry by implementing stricter physical security measures, monitoring for unauthorized hardware changes during boot, and restricting sensitive memory-management operations.

The threat posed by DDRop is currently limited by the necessity of physical access. As the researchers noted, this could potentially be leveraged by malicious insiders in a data center, compromised supply chains, or entities acting under legal compulsion. With the release of the board designs, controller firmware, and proof-of-concept code on GitHub, the industry is now tasked with evaluating the risk of such hardware-based exploits and accelerating the integration of more robust, future-proof memory encryption technologies. The forthcoming presentation at ACM CCS 2026 is expected to serve as a catalyst for deeper academic and industrial discussion on the necessity of hardware-based freshness guarantees in the next era of cloud computing.