DDRop hardware attack breaks confidential computing memory protection by silently dropping data writes
A team of security researchers from KU Leuven, ETH Zurich, Durham University, and Google has unveiled a sophisticated hardware-based vulnerability dubbed DDRop, which successfully bypasses the security guarantees of contemporary confidential computing architectures. By deploying a low-cost, custom-built circuit board known as an interposer, the researchers demonstrated the ability to compromise the memory integrity of systems utilizing Intel TDX, Intel Scalable SGX, and AMD SEV-SNP. This discovery represents a significant escalation in the physical attack landscape, as it marks the first time an active interposer has successfully circumvented the security protocols of DDR5 memory, the industry standard for modern cloud infrastructure.
The Mechanism of the DDRop Vulnerability
At its core, confidential computing is designed to ensure that data in use remains encrypted and inaccessible even to the cloud service provider itself. However, these systems prioritize performance and scalability by omitting a critical security guarantee known as "freshness." While the processor can verify that data fetched from memory is encrypted and authentic, it lacks a mechanism to confirm that the data is the most recent version.
DDRop exploits this architectural oversight. The attack utilizes an interposer—a specialized hardware device costing less than $200—positioned physically between the processor and the memory module. When the system attempts to write new data to memory, the interposer intercepts the operation, forces a deliberate command error, and suppresses the error report to the memory controller. Because the memory module silently discards the write command, the processor continues to read the stale, previously encrypted data. The hardware encryption engine, unaware that a write was suppressed, treats the old data as valid, effectively allowing an attacker to manipulate the system state by forcing it to revert to previous, attacker-controlled values.
A Departure from Previous Research
The cybersecurity community has long monitored the potential for interposer attacks, but historical methods faced significant technical hurdles. Earlier efforts, such as the "TEE.fail" research, were strictly passive, relying on eavesdropping on the memory bus—a process that often required significant bandwidth reduction to function with lab-grade hardware. More aggressive, active attacks like "Battering RAM" were effective against legacy DDR4 systems by manipulating address lines. However, the architectural redesign of DDR5—specifically its command format—rendered those older techniques obsolete. DDRop distinguishes itself as the first active attack capable of operating at full DDR5 line speeds, effectively neutralizing the hardware-level defenses implemented in the newest server generation.
Implications for Intel TDX and AMD SEV-SNP
The researchers focused their primary testing on Intel’s Trust Domain Extensions (TDX). By suppressing writes to page tables, the team successfully forced the processor to map memory to locations containing pre-loaded, attacker-controlled data. This manipulation granted them unauthorized access to the private memory of virtual machines (VMs). In one demonstrated scenario, the researchers toggled a victim VM into debug mode, extracted sensitive data in plaintext, and subsequently restored the original memory state to leave no forensic footprint.
Furthermore, the team successfully forged "launch measurements"—the cryptographic signatures used by remote customers to verify that a cloud-based VM has initialized in a known, secure state. By compromising these measurements, an attacker could potentially masquerade as a trusted service, bypassing the very attestation mechanisms that underpin the trust model of cloud computing.
While the attacks against Intel TDX were extensive, the impact on AMD SEV-SNP was found to be more constrained. In the case of AMD, the researchers demonstrated that they could manipulate the page-relocation feature to copy contents between victim pages, though they did not replicate the full range of debug-mode and attestation-forgery attacks seen on the Intel platform.
Industry Response and Threat Model Boundaries
The discovery of DDRop has reignited a long-standing debate regarding the scope of threat models for confidential computing. Both Intel and AMD have formally responded to the research, maintaining that their current security architectures are not designed to withstand sophisticated physical interposer attacks.
Intel, in its communication, noted that physical attacks of this nature fall outside the protection boundary of its encrypted memory framework. The company has clarified that it does not intend to issue Common Vulnerabilities and Exposures (CVE) identifiers for this research, characterizing the findings as "out of scope, but not out of mind." Intel pointed to its optional cryptographic-integrity mode as a partial mitigation, which adds a layer of protection against the specific data-tampering observed in the researchers’ tests.
AMD echoed this sentiment, emphasizing that the requirement for physical access to the server hardware places the attack outside the parameters of the published threat model for SEV/SNP. As of mid-September 2026, both companies have indicated they are evaluating the research as they continue to develop future generations of memory encryption hardware.
Broader Cybersecurity Context
The vulnerability highlights the inherent tension between the massive scale required for modern cloud operations and the granular security checks necessary to guarantee data integrity. Implementing a full "freshness" check for every memory operation would introduce significant latency, a trade-off that current confidential computing designs have deliberately avoided to maintain performance parity with non-encrypted environments.
The researchers emphasize that the barrier to entry for this attack is exceptionally low. The interposer, which can be manufactured for approximately $159 in parts, requires only brief physical access to a server—a scenario that could manifest through supply chain compromise, malicious insiders within a data center, or legal seizure of hardware. While there is currently no evidence that DDRop has been utilized in the wild, the publication of the board designs, controller firmware, and exploit code on GitHub provides a roadmap for potential adversaries.
Mitigation Challenges and Future Outlook
Because the vulnerability is rooted in hardware design, there is no simple software patch available to fully remediate the risk. The research team suggests that while software-level restrictions on memory management and rigorous boot-time integrity checks could raise the bar for attackers, the ultimate solution requires a fundamental shift in hardware architecture.
Proposals such as "cache-line versioning" have been discussed within the industry as a potential path toward introducing freshness checks on the memory bus. However, the efficacy of such measures against advanced interposer techniques remains a subject of ongoing academic and industry debate. As the industry moves toward more robust memory-encryption standards, the findings from the DDRop team serve as a critical reminder that the physical layer of the computing stack remains a vital and often overlooked component of the cloud security perimeter.
The researchers are scheduled to present their full findings at the ACM CCS 2026 conference in November. Until then, their work stands as a comprehensive analysis of the limitations of hardware-based memory encryption, providing a foundation for future improvements in the design of secure, scalable cloud infrastructure. The industry remains at a crossroads, balancing the demand for high-performance cloud services with the necessity of defending against increasingly sophisticated physical-layer exploits.
