New DDRop Attack Breaks Intel TDX and AMD SEV-SNP With $159 DDR5 Device

Key Takeaways

• A new hardware attack, dubbed DDRop, compromises confidential cloud systems utilizing Intel TDX and AMD SEV-SNP.
• The attack leverages a custom, low-cost ($159) DDR5 interposer to manipulate memory write commands, leading to data integrity failures.
• DDRop exploits a vulnerability where memory encryption designs (Intel TDX, Intel Scalable SGX, AMD SEV-SNP) do not fully verify the freshness of cached data.
• Successful exploitation requires privileged control of the target host and brief physical access to install the device.
• The attack poses a significant risk to cloud infrastructure, colocation facilities, and supply chains where physical server access is possible.

A novel hardware attack, named DDRop, has been revealed to bypass the security mechanisms of Intel TDX and AMD SEV-SNP, critical technologies designed to protect confidential cloud environments. This physical attack, which is not malware-based, demonstrates that even systems engineered to isolate customer data from server operators can be compromised through direct manipulation of the DDR5 memory path.

The core of confidential computing relies on isolating workloads within trusted execution environments (TEEs), ensuring data remains secure even if the underlying operating system or hypervisor is compromised. Previous research has challenged these trust boundaries, with some findings demonstrating that a malicious virtual machine manager could observe patterns within Intel TDX-protected domains. DDRop, however, escalates this concern by attacking a lower level: the memory commands exchanged between the processor and server memory.

Researchers detailed their findings in GitHub research materials said in a report, explaining that DDRop employs a specially designed DDR5 registered DIMM (RDIMM) interposer. This device is capable of interfering with memory write operations at normal operating speeds. The project includes comprehensive resources such as hardware schematics, controller firmware, host tools, and proof-of-concept attack code for the affected platforms. The attack necessitates privileged control over the target host and temporary physical access to install the interposer.

While the requirement for physical access limits the threat to typical end-users, it presents a severe risk for environments like cloud infrastructure, data centers, and supply chain operations where adversaries might gain temporary physical access to servers during maintenance or transit. The implications are particularly significant for confidential computing services that promise strong data isolation.

New DDRop Attack Breaks Intel TDX

The custom interposer used in the DDRop attack was constructed from parts costing approximately $159, excluding labor and development expenses. This device is inserted between the CPU and a DDR5 RDIMM. Instead of directly reading application data, it manipulates memory command signals. The interposer is engineered to induce parity failures, causing the memory module to silently reject specific write commands without properly alerting the system. More technical details are available in the research paper.

This silent discarding of writes means that a protected virtual machine might subsequently read outdated data that should have been overwritten. This mechanism forms the fundamental primitive of the DDRop attack. The researchers discovered that Intel TDX, Intel Scalable SGX, and AMD SEV-SNP are susceptible because their scalable memory encryption designs do not thoroughly verify whether encrypted memory contains the most current version of each cache line. This is a critical distinction, as encryption ensures data confidentiality but does not guarantee its freshness or integrity. Similar low-level vulnerabilities concerning DRAM scrambling have previously highlighted how changes beneath the operating system can circumvent controls that assume memory addresses remain static.

TDX and SEV-SNP Security Impact

The DDRop attack becomes particularly potent when combined with trusted memory-management interfaces exposed to a malicious host. The researchers demonstrated that an attacker could disrupt page relocation operations, forcing a destination page to retain stale content. During their testing, this technique allowed for the deterministic copying of plaintext data between pages within the same confidential virtual machine.

For Intel TDX, the team also successfully injected malicious Secure Extended Page Table entries. This capability grants an attacker control over protected address translations, creating pathways for accessing victim ciphertext, executing replay attacks, and corrupting sensitive control structures. Furthermore, the researchers showed how these attacks could force a trust domain into debug mode or forge an expected attestation measurement, undermining the very foundation of trust in these confidential environments. The full technical details are available in the

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.