Researchers have disclosed a brand new {hardware} assault, referred to as DDRop, that breaks the reminiscence safety in Intel and AMD confidential computing by silently dropping writes to a server’s reminiscence, so the processor retains studying outdated encrypted knowledge as if it had been present.
The assault requires an attacker who already controls the server’s software program and might briefly entry the machine to insert a small circuit board, referred to as an interposer, between the processor and a reminiscence module.
The interposer prices underneath $200 to construct. DDRop works towards Intel TDX, Intel Scalable SGX, and AMD SEV-SNP, the {hardware} that cloud companies use to maintain buyer knowledge personal whereas it’s in use, even from the cloud supplier.
Confidential computing retains a server’s reminiscence encrypted, in order that even somebody with bodily entry to the machine sees solely scrambled knowledge. To cowl the big quantity of reminiscence {that a} cloud server makes use of, although, these designs omit a assure referred to as freshness. The processor can affirm that reminiscence is encrypted, however not that it holds the newest written worth, and that outdated encrypted knowledge nonetheless decrypts accurately.
DDRop turns that hole into an assault. When the interposer drops a write, the sooner worth stays in reminiscence, and the processor reads it again as if the replace had occurred. The encryption engine detects nothing mistaken.
DDRop is the primary energetic interposer assault to work on the DDR5 reminiscence in immediately’s cloud servers, the researchers say, and the primary to interrupt the integrity of an up-to-date Intel TDX system reasonably than solely learn knowledge from it.
Earlier DDR5 interposer assaults, resembling TEE.fail, had been passive. They listened to the reminiscence bus and needed to sluggish it right down to work with second-hand lab gear. Lively assaults that modified what the reminiscence noticed, resembling Battering RAM, labored solely on older DDR4, and DDR5’s redesigned command format blocks the address-swapping trick they used. DDRop will get round that by dropping writes as a substitute.
The interposer is a small board of switches that sits on the reminiscence bus and runs at full DDR5 velocity. To drop a write, it forces an error on the command bus after which cuts the wire the reminiscence module makes use of to report that error, so the module quietly discards the command and the processor isn’t instructed.
DDRop is the work of researchers at KU Leuven, ETH Zurich, Durham College, and Google, and is because of be introduced on the ACM CCS 2026 convention in November. The workforce says it’s releasing the interposer’s board designs, controller firmware, and assault code on GitHub, alongside their analysis paper.
Breaking Intel TDX
On Intel TDX, the researchers turned write-dropping into full management of a protected digital machine. TDX retains every digital machine’s web page tables encrypted and underneath the management of trusted firmware.
When that firmware writes empty entries to arrange a brand new web page desk, DDRop drops these writes, so the desk as a substitute retains attacker-chosen knowledge left in that reminiscence beforehand. That lets an attacker’s personal digital machine map its reminiscence onto any bodily deal with and browse or change protected reminiscence.
With that entry, the researchers learn a sufferer digital machine’s personal reminiscence and switched a sufferer machine into debug mode, which allow them to copy its reminiscence in plaintext after which restore the unique knowledge so the sufferer confirmed no signal of tampering.
In addition they overwrote the launch measurement {that a} digital machine makes use of to show to a distant buyer that it began in a identified, trusted state. With that modified, a digital machine the attacker controls may cross that examine as if it had been a trusted one.
Two of those outcomes, studying a sufferer’s reminiscence and toggling debug mode, had been proven solely underneath TDX’s default mode, referred to as logical integrity. TDX’s optionally available, stronger mode, referred to as cryptographic integrity, would block them, the researchers say, as a result of each contain altering knowledge that belongs to a different digital machine.
Forging a machine’s personal attestation, they argue, would nonetheless work underneath the stronger mode, as a result of that write occurs contained in the attacker’s personal digital machine and underneath its personal key, so the {hardware} nonetheless marks the info as legitimate. Cryptographic integrity doesn’t add a freshness examine both, so it can’t inform that outdated contents had been reused. Their take a look at system didn’t assist the mode, so they might not affirm this.
On AMD SEV-SNP, the result’s narrower. Dropping writes throughout AMD’s page-relocation function let the researchers copy the contents of 1 sufferer web page into one other, however the debug-mode and attestation-forgery assaults are particular to Intel TDX.
All three applied sciences encrypt reminiscence with out the freshness examine DDRop exploits, so all three are affected. Intel’s older Consumer SGX, utilized in some desktop and laptop computer chips, is just not, as a result of it makes use of a {hardware} integrity tree that catches stale knowledge, although Intel has since retired it.
NVIDIA’s confidential-computing GPUs are out of attain, as a result of their reminiscence sits contained in the chip bundle the place an interposer can’t be fitted. The researchers didn’t take a look at Arm’s CCA and say it might be affected too.
The assault is aimed toward cloud servers, not dwelling computer systems or telephones. Intel TDX, Scalable SGX, and AMD SEV-SNP are supplied by main cloud platforms, together with AWS, Microsoft Azure, and Google Cloud, to guard buyer workloads. DDRop doesn’t present that any of those companies has been damaged into.
It exhibits that an attacker with the suitable entry and an inexpensive piece of {hardware} may undermine the safety these companies depend on.
The researchers instructed The Hacker Information they don’t have any proof of DDRop or a comparable energetic interposer getting used outdoors a laboratory.
No Easy Patch
There isn’t any easy patch. The weak point is within the {hardware} design, the researchers say. Right now’s scalable reminiscence encryption provides up the freshness examine in trade for shielding massive quantities of reminiscence, and shutting the hole for good would wish new memory-encryption {hardware} that provides each integrity and freshness.
Software program modifications can elevate the bar with out eradicating the basis trigger. These embrace limiting the memory-management options DDRop abuses, checking that vital writes truly landed, and on the lookout for an interposer throughout boot.
Intel and AMD had been knowledgeable about DDRop upfront by coordinated disclosure, and each acknowledged the findings and would concern safety bulletins on the disclosure date. Neither firm supplied mitigation steering or a timeline, the researchers mentioned.
AMD instructed The Hacker Information that as a result of the assault requires bodily entry to the system, it falls outdoors the scope of the printed risk mannequin for SEV / SNP.
Intel takes the identical place on bodily assaults towards server reminiscence.
Intel has individually mentioned that bodily interposer assaults of this sort fall outdoors the safety offered by its reminiscence encryption, and that it doesn’t plan to assign such assaults a CVE.
It has additionally described this analysis space as “out of scope, however not out of thoughts.” Intel’s optionally available cryptographic-integrity mode, out there on some present Xeon processors, already blocks a part of DDRop, and Intel says it’s engaged on stronger memory-encryption designs for future chips.
A type of proposals, referred to as cache-line versioning, would add a freshness examine to the reminiscence bus. The researchers say it’s unclear whether or not it could cease DDRop, and that Intel has not mentioned whether or not it could.
AMD mentioned its bulletin on DDRop is because of be printed on its product safety web page afterward September 14. Intel didn’t reply to a request for remark earlier than publication.
Constructing the interposer is affordable. The researchers put the elements for one unit at about $159, not counting growth or labor, and say it may be fitted in minutes after which pushed completely from software program.
As a result of it wants just one temporary go to to the machine, the researchers say the entry it requires may come from a rogue data-center worker, tampering someplace within the provide chain, or {hardware} seized underneath authorized compulsion.
