DDRop Hardware Attack Exposes Critical Vulnerabilities in Intel and AMD Confidential Computing Memory Protection

A new, sophisticated hardware-based security vulnerability named DDRop has been disclosed by a collaborative team of researchers from KU Leuven, ETH Zurich, Durham University, and Google. The attack demonstrates that the "confidential computing" frameworks relied upon by modern cloud infrastructure providers to secure sensitive data are fundamentally susceptible to physical interposition. By utilizing a low-cost, custom-built circuit board known as an interposer, attackers can intercept and manipulate the communication between a server’s processor and its DDR5 memory modules, effectively bypassing existing encryption safeguards.

This discovery highlights a significant architectural limitation in how major cloud providers, including AWS, Microsoft Azure, and Google Cloud, currently implement memory encryption. While these systems successfully encrypt data to prevent unauthorized reading during transit or at rest, they lack a "freshness" guarantee. Consequently, a processor can confirm that data is encrypted, but it cannot verify that the data it is reading is the most recently written version. DDRop exploits this gap by silently dropping write commands, forcing the CPU to process stale, outdated data while operating under the false assumption that it is interacting with current, valid information.

The Mechanics of the DDRop Attack

The DDRop attack is categorized as an active hardware-based exploit. Unlike passive side-channel attacks that merely observe data patterns or timing, DDRop actively manipulates the memory bus. To execute this, an attacker must have physical access to the target server for a limited window of time, allowing them to install an interposer—a small, inexpensive circuit board—directly between the processor and the system’s RAM.

The interposer operates at full DDR5 speeds, making it significantly more advanced than previous iterations of hardware exploits. When the interposer identifies a specific write command it intends to disrupt, it triggers a deliberate error on the command bus. Crucially, the device then severs the physical wire that the memory module uses to report this error back to the processor. As a result, the memory module silently discards the write instruction, and the processor remains entirely unaware that the update failed, proceeding to pull the previous, stale data from the memory bank.

Because the encryption engine is not alerted to any inconsistency, the decrypted data appears legitimate to the software, even though the state of the machine has been tampered with. This capability allows an attacker to manipulate the internal state of a protected virtual machine (VM) by essentially "rolling back" memory updates, creating opportunities to inject malicious code, manipulate page tables, or bypass security-critical validation checks.

Chronology and Research Genesis

The disclosure of DDRop is the culmination of extensive research into the vulnerabilities of modern memory architectures. While researchers have explored memory bus interposition for years, the transition to DDR5 presented significant hurdles due to redesigned command formats that rendered older, DDR4-based attacks ineffective.

The timeline of this research reflects a methodical breakdown of modern TEE (Trusted Execution Environment) defenses:

• Initial Research Phase (2024): The team began investigating the feasibility of active interposition on high-speed DDR5 memory, moving away from the limitations of passive listening techniques seen in earlier projects like TEE.fail.
• Development and Prototyping (Early 2025): The researchers successfully developed an interposer capable of operating at full bandwidth, costing approximately $159 to produce.
• Validation of Vulnerability (Mid-2025): Testing confirmed that both Intel TDX (Trust Domain Extensions) and AMD SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) were susceptible to write-dropping attacks.
• Coordinated Disclosure (Late 2025 – 2026): The findings were shared with Intel and AMD under a coordinated disclosure process to allow for internal review before public presentation.
• Public Presentation (November 2026): The research is scheduled for formal presentation at the ACM CCS 2026 conference, accompanied by the release of board designs and firmware on GitHub.

Impact on Intel TDX and AMD SEV-SNP

The researchers focused heavily on Intel’s TDX and AMD’s SEV-SNP, as these technologies represent the industry standard for cloud-based confidential computing. On Intel TDX, the team demonstrated the ability to gain full control of a protected virtual machine. By dropping specific write operations during the initialization of new page tables, the attackers could force the system to utilize stale, attacker-controlled memory. This allowed them to map their own malicious virtual memory onto arbitrary physical addresses, granting them the power to read or modify protected data.

In more advanced scenarios, the researchers were able to toggle a victim VM into "debug mode," facilitating the extraction of memory contents in plaintext. Furthermore, they successfully forged launch measurements—the cryptographic signatures used to prove to remote users that a virtual machine has booted in a secure, unaltered state. By tampering with these measurements, an attacker could potentially masquerade as a trusted entity, effectively subverting the entire remote attestation process.

While AMD’s SEV-SNP was also found to be vulnerable, the exploit surface was described as narrower. The research showed that by dropping writes during AMD’s page-relocation operations, an attacker could copy the contents of one memory page to another. However, the specific techniques used to bypass TDX’s debug mode and attestation were not directly applicable to the AMD architecture.

Industry Response and Threat Models

Both Intel and AMD have responded to the research by emphasizing that the attack falls outside the scope of their established threat models. Both manufacturers maintain that physical access to a server constitutes a breach of the environment that exceeds the security guarantees provided by memory encryption.

AMD noted in its security documentation that because DDRop necessitates direct, physical interaction with the server hardware, it is not considered a viable threat within the context of standard remote-attack vectors. Intel has taken a similar stance, clarifying that its current memory encryption frameworks are not designed to protect against adversaries with the physical capability to install interposers on the motherboard. Consequently, Intel has stated it does not intend to issue a CVE (Common Vulnerabilities and Exposures) identifier for this research.

Despite this, the companies acknowledge the importance of the findings. Intel has stated that its newer processors, which support an optional "cryptographic integrity" mode, already mitigate some aspects of the DDRop attack. However, the researchers point out that even this stronger mode lacks a freshness check, meaning it cannot inherently detect the reuse of stale data. Intel has indicated that it is exploring future architectural improvements, such as "cache-line versioning," which could potentially address the freshness gap, though the effectiveness of these measures against specialized interposition remains unproven.

Broader Implications for Cloud Security

The DDRop vulnerability serves as a stark reminder that confidential computing is not a panacea for all security threats. While it provides robust protection against remote adversaries and malicious cloud administrators who might attempt to inspect memory via software-based exploits, it remains vulnerable to sophisticated, hardware-level physical tampering.

For data center operators, the implications are clear: the security of the cloud is only as strong as the physical security of the server hardware itself. The "trusted" nature of these servers relies on the assumption that the physical supply chain and the data center floor are secure environments. The ability to execute this attack in minutes suggests that risks such as insider threats, supply chain interdiction, or physical seizure of hardware under legal mandate must be re-evaluated as legitimate security concerns for organizations handling highly sensitive data.

There is currently no simple software-based patch for DDRop. Because the vulnerability is rooted in the hardware design—specifically the trade-off between the overhead of freshness checks and the performance requirements of large-memory servers—fixing it would likely require fundamental changes to future processor and memory controller architectures. Until such hardware updates are available, organizations are limited to defensive measures such as hardening physical access controls, monitoring for hardware anomalies, and implementing stricter, multi-layered integrity verification processes at the software level.

As the industry moves toward increasingly granular and secure computing environments, the DDRop research underscores the ongoing struggle to balance performance, scalability, and high-assurance security in the era of cloud computing.