Researchers Expose DDRop: A Novel Hardware Attack Breaking Intel and AMD Confidential Computing Memory Protection

The cybersecurity landscape faces a profound challenge following the disclosure of a sophisticated hardware attack known as DDRop, which successfully compromises the memory protection mechanisms of major cloud computing architectures, specifically Intel and AMD. Disclosed by a collaborative team of academic and industry researchers from KU Leuven, ETH Zurich, Durham University, and Google, the attack exploits a foundational architectural compromise in modern server memory encryption: the absence of a memory freshness guarantee. By utilizing a custom-built, low-cost circuit board termed an interposer, attackers can silently drop write operations to a server’s memory modules, forcing processors to read stale, encrypted data as if it were current and legitimate.

This vulnerability affects leading confidential computing environments, including Intel Trust Domain Extension (TDX), Intel Scalable Software Guard Extensions (SGX), and AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP). These hardware-based security technologies are heavily relied upon by global cloud providers—such as Amazon Web Services, Microsoft Azure, and Google Cloud—to ensure that customer data remains encrypted and isolated from unauthorized entities, including the cloud infrastructure providers themselves. While the attack requires initial software control of the compromised server and temporary physical access to install the interposer, its realization highlights deep-seated vulnerabilities in how enterprise-grade hardware handles high-speed DDR5 memory integrity.

The research team is scheduled to formally present their findings in November at the ACM Conference on Computer and Communications Security (CCS) 2026. In the interest of open science and defensive preparedness, the investigators have made their research paper publicly available, alongside releasing the interposer’s schematic board designs, controller firmware, and exploit code on GitHub.

Understanding Confidential Computing and the Freshness Gap

To contextualize the gravity of the DDRop attack, it is necessary to examine the architectural evolution of confidential computing. As organizations increasingly migrate sensitive workloads, proprietary algorithms, and personally identifiable information to multi-tenant cloud environments, data privacy in use has become a paramount concern. Traditionally, data is encrypted at rest (stored on disk) and in transit (moving across networks), but it must be decrypted into plaintext in system memory (RAM) to be processed by the CPU. This left a critical security gap where rogue administrators, hypervisor compromises, or malicious processes could theoretically inspect raw memory contents.

To mitigate this threat, silicon manufacturers developed confidential computing hardware frameworks. Technologies like AMD SEV-SNP and Intel TDX enforce hardware-level memory encryption, ensuring that virtual machines operate within isolated, encrypted execution domains. The memory controller features an integrated encryption engine that scrambles data as it leaves the processor and unscrambles it upon return.

However, protecting massive amounts of server RAM introduces immense computational and architectural overhead. To scale encryption efficiently across hundreds of gigabytes or terabytes of DDR5 memory without introducing crippling performance latency, chip designers made a pragmatic engineering trade-off: they omitted memory freshness verification. While the hardware can cryptographically verify that data residing in a specific memory address is authentic and encrypted using the correct key, it cannot determine whether that data represents the most recently written value or a stale piece of data from an earlier point in time.

The DDRop methodology capitalizes directly on this foundational oversight. By artificially preventing an update from successfully committing to the memory module, the system fails to recognize that an older record is being substituted for a newer one. The encryption engine successfully decrypts the stale data, and the processor continues normal execution entirely unaware that memory state manipulation has occurred.

The Mechanics of DDRop: Engineering a Low-Cost Interposer

Prior hardware attacks targeting modern server memory architectures were often limited by technological constraints. Earlier passive side-channel attacks, such as TEE.fail, merely listened to memory bus traffic and required researchers to artificially throttle memory speeds using specialized laboratory equipment. Conversely, active hardware interventions like the Battering RAM attack were capable of manipulating memory states, but they were strictly limited to older DDR4 memory architectures. The completely redesigned command and signaling format of DDR5 memory effectively blocked the address-swapping manipulation techniques that Battering RAM relied upon.

DDRop overcomes these barriers by pivoting from data modification to write suppression. The core of the attack is a physical hardware component known as an interposer—a small, custom-engineered printed circuit board populated with high-speed switches. Crucially, the materials required to manufacture a DDRop interposer are inexpensive, with the researchers estimating the component cost for a single unit to be approximately $159, excluding labor and initial design overhead.

The interposer is designed to be physically inserted directly into the memory bus, sitting snugly between the server’s central processor and a DDR5 memory module. Operating at full operational speed, the interposer seamlessly matches the high data rates of modern server hardware without introducing anomalous performance lags that might trigger automated intrusion detection systems.

To execute a write-dropping maneuver, the interposer forces a deliberate command bus error on the targeted write operation. Simultaneously, it physically severs or suppresses the specific wire that the memory module utilizes to report that error back to the system. Consequently, the memory module quietly discards the incoming write command, while the CPU is never informed that the instruction failed. The previous value remains undisturbed in the physical memory cells, ready to be read back during subsequent processing cycles.

Targeting Intel TDX and AMD SEV-SNP

The practical implications of write-dropping manifest differently across various confidential computing architectures, with Intel TDX proving particularly vulnerable to comprehensive administrative exploitation.

On Intel TDX systems, the researchers successfully transformed the DDRop write-dropping capability into full control over protected virtual machines. Intel TDX relies on trusted firmware to maintain and manage encrypted page tables for individual virtual machines. When this trusted firmware attempts to initialize new page tables by writing empty or default entries, the interposer intercepts and drops those specific write commands. As a result, the page table retains pre-existing, attacker-controlled data that had been intentionally left in that specific region of memory beforehand.

This manipulation grants an attacker’s virtual machine the ability to remap its own memory space onto arbitrary physical memory addresses, allowing it to read or modify protected memory regions allocated to other workloads. Utilizing this unauthorized access, the research team successfully executed several severe security breaches in a testing environment:

• Private Memory Inspection: The researchers read the confidential contents of a victim virtual machine’s private memory space.
• Administrative Mode Toggle: They forced a victim virtual machine into an internal debugging mode, enabling them to copy its sensitive memory contents in plaintext before seamlessly restoring the original data to evade detection.
• Attestation Forgery: They successfully overwrote the cryptographic launch measurements that a virtual machine uses to prove its structural integrity and secure boot state to remote cloud customers, allowing a compromised virtual machine to masquerade as a fully trusted instance.

The researchers noted that certain advanced security configurations impact the feasibility of specific attack vectors. Under Intel TDX’s default operating mode, known as logical integrity, memory reading and debug-mode toggling are fully achievable. Intel offers an optional, more rigorous setting called cryptographic integrity, which is designed to block unauthorized cross-VM data alterations. However, the researchers emphasize that even under cryptographic integrity, attestation forgery remains theoretically viable because the falsified write operation occurs entirely within the attacker’s localized virtual machine context using its own cryptographic keys, causing the hardware to process the forged measurement as valid data. Because cryptographic integrity still lacks a freshness verification mechanism, it remains blind to the reuse of stale data states.

For AMD SEV-SNP environments, the impact of DDRop is somewhat more restricted. While dropping write operations during AMD’s specialized page-relocation operations allowed researchers to duplicate the contents of one victim memory page into another, the more invasive debug-mode manipulation and attestation forgery attacks observed on Intel TDX remain specific to the Intel ecosystem.

Notably, older Intel Client SGX architectures—historically utilized in consumer-grade desktop and laptop processors—are immune to DDRop because they implement a hardware integrity tree structure that actively detects and flags stale data states. Furthermore, NVIDIA confidential computing graphics processing units remain physically shielded from interposer-based attacks because their high-bandwidth memory arrays are tightly integrated directly within the processor package itself. Arm Holdings’ Confidential Compute Architecture (CCA) was not formally evaluated by the research team, though analysts suggest it may share similar underlying design exposures.

Coordinated Disclosure and Industry Response

In accordance with responsible disclosure practices, the research team notified both Intel and AMD well in advance of their public presentation. Both semiconductor giants acknowledged the findings, with formal security bulletins published alongside the release of the academic paper.

However, the response from the hardware manufacturers highlights a fundamental disagreement regarding threat models and operational scope. Both Intel and AMD maintained that attacks requiring direct physical access to enterprise server hardware fall strictly outside the boundaries of their published security guarantees and threat models.

Intel issued explicit guidance clarifying that physical interposer attacks of this nature reside outside the protective scope of its memory encryption frameworks and confirmed that it does not plan to assign Common Vulnerabilities and Exposures (CVE) identifiers to the DDRop findings. Despite this stance, Intel characterized the research area as "out of scope, but not out of mind," pointing out that its existing optional cryptographic-integrity mode already mitigates several aspects of the attack. Furthermore, the company indicated that its engineers are actively researching advanced memory-encryption methodologies for future processor generations, including proposed architectural enhancements such as cache-line versioning designed to introduce bus-level freshness checks.

AMD similarly reiterated that because DDRop necessitates direct physical interaction with the server hardware—such as opening server chassis enclosures and physically installing interposer circuitry—the exploit violates the foundational assumptions of the SEV-SNP security architecture.

Industry analysts emphasize that physical access vulnerabilities of this caliber cannot be easily mitigated through standard software patches or microcode updates. Because the root vulnerability is deeply embedded in the hardware design priorities of scalable memory encryption—which intentionally sacrificed freshness checks to achieve high-capacity performance—defending against interposer attacks will ultimately require structural redesigns in future silicon generations.

In the interim, cloud service providers and enterprise datacenters must rely on defense-in-depth physical security measures to manage the residual risk. Because the interposer requires only a brief window of physical interaction to install, threat vectors could theoretically involve compromised supply chain logistics, malicious actors operating within datacenter facilities, or state-sponsored physical seizures under legal compulsion. Consequently, organizations utilizing confidential computing are urged to strengthen physical datacenter security protocols, implement rigorous tamper-detection chassis monitoring, and deploy advanced boot-time attestation audits to ensure that server hardware integrity remains uncompromised before deploying sensitive cloud workloads.