A team of security researchers from KU Leuven, ETH Zurich, Durham University, and Google has disclosed a sophisticated new hardware-level attack, dubbed "DDRop," which compromises the memory protection mechanisms of major confidential computing platforms. By utilizing a low-cost, custom-built hardware interposer, the researchers successfully bypassed the security guarantees of Intel TDX, Intel Scalable SGX, and AMD SEV-SNP. The attack functions by intercepting and silently dropping memory write operations, effectively forcing the processor to rely on stale, encrypted data. This exploit highlights a fundamental architectural trade-off in modern cloud security: the omission of "freshness" checks in large-scale memory encryption designs.
Understanding the Mechanism of DDRop
Confidential computing aims to protect data in use by keeping it encrypted while residing in system memory. This ensures that even in scenarios where an attacker gains physical or administrative access to a server, the sensitive data remains obfuscated. However, these systems primarily focus on confidentiality and basic integrity, often failing to verify the "freshness" of the data being retrieved.
DDRop exploits this gap. When the processor requests data, the hardware encryption engine decrypts whatever is currently stored at that memory address. If the data is stale—meaning the latest update was never written due to the interposer’s interference—the processor accepts it as valid because the decryption process succeeds without error.
The attack requires an attacker to physically insert a small, custom-designed circuit board, known as an interposer, between the CPU and the memory module. Constructed for less than $200, this device operates at full DDR5 speeds. When the interposer identifies a targeted write command, it induces a deliberate error on the command bus and simultaneously severs the feedback wire the memory module uses to report the fault. The result is a "silent drop": the memory module discards the command, the processor remains unaware that the write failed, and the system continues operation using obsolete data.
Chronology and Development
The discovery of DDRop follows a series of advancements in side-channel and physical hardware attacks. Earlier research, such as the "TEE.fail" exploit, focused on passive observation of memory buses. While effective at data leakage, passive attacks often required laboratory-grade equipment and caused noticeable latency, making them less practical for real-world deployment.
Previous active attacks, such as "Battering RAM," successfully manipulated memory on older DDR4 systems by leveraging address-swapping techniques. However, the introduction of DDR5 brought a redesigned command format that rendered those specific methods obsolete. DDRop represents a significant evolution in this field, as it is the first active interposer attack capable of operating at the high speeds required for modern DDR5-equipped cloud infrastructure, while simultaneously breaking the integrity of up-to-date Intel TDX environments.
The researchers are scheduled to present their findings at the ACM Conference on Computer and Communications Security (CCS) in November 2026. In the spirit of academic transparency and coordinated disclosure, the team has made the interposer’s schematics, controller firmware, and proof-of-concept attack code publicly available on GitHub.
Exploiting Intel TDX and AMD SEV-SNP
The impact of DDRop varies depending on the underlying architecture. On Intel TDX, the researchers demonstrated that write-dropping could be weaponized to gain full control over a protected virtual machine (VM). By dropping the writes that the trusted firmware uses to initialize empty page tables, the researchers forced the system to utilize attacker-chosen data that had been pre-positioned in memory. This allowed the attacker to map their own memory onto arbitrary physical addresses, effectively reading or modifying protected data belonging to other virtual machines.
Furthermore, the team successfully toggled a victim machine into "debug mode," a state that allows for the decryption and extraction of memory contents in plaintext. Once the data was exfiltrated, the researchers restored the original state, leaving no forensic footprint of the intrusion. In a separate test, they demonstrated the ability to forge the launch measurements that remote customers use to verify the integrity of a trusted execution environment.
On AMD SEV-SNP systems, the attack surface is slightly more constrained. While the researchers successfully utilized write-dropping to manipulate the page-relocation process—enabling the copying of memory between pages—the specific debug-mode and attestation-forgery exploits were found to be unique to the Intel TDX implementation.
The Problem of Physical Access and Threat Modeling
Both Intel and AMD have maintained that physical attacks of this nature fall outside their defined threat models. In the industry-standard view of confidential computing, the server hardware is considered a "trusted" component. If an attacker has sufficient physical access to install hardware inside a data center, the security perimeter is already considered compromised.
Intel, in particular, has noted that its memory encryption frameworks are not designed to protect against physical interposition. The company has declined to assign a Common Vulnerabilities and Exposures (CVE) identifier to the findings, characterizing the research as "out of scope, but not out of mind." Intel representatives have pointed to their optional "cryptographic integrity" mode as a potential defense, which provides stronger protections than the default "logical integrity" mode, though it does not fully address the underlying lack of freshness verification.
AMD has also addressed the findings, emphasizing that the requirement for direct, physical access to the server hardware places the DDRop attack outside the scope of their published security guarantees for the SEV/SNP architecture.
Implications for Cloud Security
The existence of DDRop underscores a significant hurdle for the future of cloud computing. The industry currently faces a technical impasse: adding a full "freshness" check to every memory operation would require substantial redesigns of memory controllers and potentially impose significant performance overheads, which could negate the benefits of utilizing high-speed DDR5 memory.
While there is no simple software patch for this hardware-level flaw, researchers suggest that companies could implement defensive measures to raise the bar for attackers. These include:
- Enhanced Integrity Checks: Verifying that critical memory writes have successfully landed in physical storage.
- Hardware Inspection: Implementing physical tamper-detection mechanisms within server chassis to identify the presence of unauthorized interposers during boot or maintenance cycles.
- Restricted Memory Management: Reducing the attack surface by limiting the specific memory-management features that the DDRop attack relies upon.
The researchers remain cautious about the long-term viability of current encryption designs. They noted that even upcoming proposals, such as "cache-line versioning," which intends to introduce freshness checks, have yet to be proven effective against sophisticated active interposition.
Broader Landscape
DDRop is not currently known to be in use outside of controlled laboratory settings. The complexity involved in gaining physical access to a server, coupled with the precision required to install an interposer, makes this an attack vector primarily reserved for highly motivated actors, such as those with access to data-center facilities or the ability to compromise supply-chain logistics.
Despite the limited scope of the attack, the disclosure serves as a critical warning to the industry. As confidential computing becomes the standard for protecting sensitive enterprise workloads—ranging from financial records to proprietary AI models—the reliance on hardware-based security must be scrutinized. The research from the multi-university team provides a roadmap for hardware architects to address the "freshness" gap in next-generation silicon, ensuring that the promise of secure cloud computing remains robust against both remote and physical threats.
As of mid-September 2026, the global security community continues to analyze the implications of these findings. While major cloud providers, including AWS, Microsoft Azure, and Google Cloud, continue to offer their respective confidential computing solutions, the DDRop disclosure highlights the necessity for ongoing evolution in hardware security architectures to maintain the trust of enterprise customers in an increasingly hostile threat landscape.
