Researchers Unveil DDRop: A Novel Hardware Attack Exploiting Freshness Vulnerabilities in Intel and AMD Confidential Computing

A team of international academic researchers and industry engineers has disclosed a sophisticated hardware attack known as DDRop, which successfully compromises memory protection mechanisms across modern Intel and AMD confidential computing environments. By silently intercepting and dropping specific memory write operations, the attack forces affected processors to read stale, encrypted data as current information, thereby breaking the foundational integrity guarantees of cloud-based trusted execution environments (TEEs).

The vulnerability, which will be formally presented at the ACM CCS 2026 conference in November, targets the DDR5 memory architecture widely utilized in contemporary enterprise cloud servers. Developed jointly by researchers from KU Leuven, ETH Zurich, Durham University, and Google, DDRop demonstrates that physical access combined with inexpensive custom hardware can fundamentally undermine server-grade memory encryption frameworks without alerting the host system or the virtualization layer.

The Mechanics of DDRop: Exploiting the Freshness Gap

Modern confidential computing technologies—specifically Intel Trust Domain Extension (TDX), Intel Scalable Software Guard Extensions (SGX), and AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP)—are designed to ensure that customer data remains encrypted in memory at all times. This prevents malicious cloud administrators, hypervisors, or other compromised software layers from inspecting sensitive payloads while workloads are actively processing.

However, to accommodate the vast quantities of memory demanded by modern cloud servers, these hardware architectures omit a critical security property known as "freshness." While the processor’s integrated memory encryption engine can verify that data retrieved from a memory module is encrypted with the correct key, it cannot mathematically guarantee that the data represents the most recent write operation performed by the CPU. If an earlier ciphertext is presented back to the processor, the decryption engine processes it successfully, completely unaware that an update was suppressed.

DDRop operationalizes this architectural limitation through an active hardware device called an interposer. Costing under $200 in raw components to manufacture, the interposer is a small custom circuit board equipped with high-speed switches. It is physically inserted into the memory bus directly between the server’s processor and a DDR5 memory module.

Operating at full DDR5 line speeds, the interposer executes its attack by intentionally introducing a command bus error during a targeted write operation. Simultaneously, it severs or masks the specific wire that the memory module uses to report transmission errors back to the controller. Consequently, the memory module quietly discards the write command, while the processor remains oblivious that the update never materialized in physical storage.

Evolution from Past Interposer Vulnerabilities

DDRop represents a significant evolutionary milestone in hardware-based side-channel and fault-injection attacks against enterprise servers. Earlier generations of DDR5 memory attacks, such as the TEE.fail side-channel methodology disclosed in late 2025, were strictly passive. Those techniques relied on monitoring electromagnetic or electrical activity on the memory bus and frequently required slowing down memory clocks or utilizing specialized laboratory equipment to extract data.

Conversely, active attacks that sought to manipulate data visibility, such as the Battering RAM attack, were previously restricted to older DDR4 memory standards. Those older attacks exploited address-swapping commands unique to DDR4 memory controllers. Because the redesigned command and signaling format of DDR5 explicitly blocks address-swapping manipulations, traditional active hardware attacks were rendered ineffective against modern server platforms—until the development of DDRop’s write-dropping technique.

Targeting Intel TDX and AMD SEV-SNP

To evaluate the real-world impact of their methodology, the research team tested DDRop against industry-standard confidential computing implementations, demonstrating varying degrees of compromise depending on the platform architecture and enabled configuration modes.

On Intel TDX systems, the attackers leveraged write-dropping to achieve full control over protected virtual machines (VMs). Intel TDX relies on trusted firmware to manage and encrypt page tables for each guest VM. By dropping the specific write operations used by this firmware to initialize empty page table entries, the interposer forced the system to retain pre-existing, attacker-controlled data within those memory locations. This manipulation enabled an unauthorized virtual machine to remap its memory space onto arbitrary physical addresses, granting unrestricted read and write access to protected memory regions.

Further exploitation on Intel TDX allowed the researchers to read the private memory of victim virtual machines, toggle a victim machine into an unauthorized debug mode for plaintext memory extraction, and forge remote attestation measurements. By rewriting the cryptographic launch measurements that remote customers rely on to verify that a cloud workload started in a known, uncompromised state, an attacker could substitute a malicious virtual machine in place of a legitimate, trusted instance.

The research team noted that two of these capabilities—reading victim memory and forcing debug mode—were demonstrated under TDX’s default configuration mode, known as logical integrity. Intel offers an optional, higher-security configuration called cryptographic integrity, which is engineered to block unauthorized cross-VM data modifications. However, because cryptographic integrity similarly omits freshness validation, the researchers concluded that attestation forgery and certain localized state manipulations would likely remain feasible even under the stronger setting.

Testing against AMD SEV-SNP yielded a narrower set of attack vectors. While dropping writes during the execution of AMD’s page-relocation routines enabled the researchers to duplicate the contents of one victim memory page into another, the more severe debug-mode and attestation-forgery exploits remained specific to Intel TDX architecture.

Scope of Vulnerability and Hardware Limitations

The vulnerability spans all three major server-side confidential computing technologies—Intel TDX, Intel Scalable SGX, and AMD SEV-SNP—due to their shared reliance on memory encryption frameworks that lack freshness validation. However, the physical constraints of server engineering limit where and how the interposer can be deployed.

Intel’s legacy Client SGX, historically deployed in consumer desktop and laptop processors, is immune to DDRop because it incorporates a dedicated hardware integrity tree capable of detecting stale data, though Intel has since phased out client-side SGX support. Similarly, NVIDIA’s high-performance confidential computing GPUs are physically protected against interposer deployment because their high-bandwidth memory (HBM) is integrated directly within the primary silicon package. The research team did not formally test Arm’s Confidential Compute Architecture (CCA), though they suggested that similar underlying memory paradigms could potentially leave it susceptible to comparable methodologies.

The threat model assumes an adversary who has achieved prior administrative control over the server’s software stack and has gained brief physical access to the machine’s interior to install the interposer. Such physical access, the researchers noted, could be achieved via compromised data center personnel, tampering within the hardware supply chain, or judicial seizure.

Coordinated Disclosure and Official Industry Responses

In accordance with responsible vulnerability disclosure practices, the researchers informed Intel and AMD of their findings prior to public release. The academic team also announced plans to publish the interposer’s complete board schematics, controller firmware, and proof-of-concept attack code on GitHub, alongside their whitepaper.

Both semiconductor manufacturers acknowledged the research but maintained that physical attacks requiring direct hardware tampering fall outside their published security threat models for enterprise server environments.

AMD issued a formal statement indicating that because DDRop necessitates direct physical intervention with server hardware, the vector falls outside the scope of the published threat model for SEV and SEV-SNP. Intel adopted a parallel stance, confirming that physical interposer attacks of this nature are not covered by the memory encryption framework’s security guarantees and stating that the company does not plan to assign Common Vulnerabilities and Exposures (CVE) identifiers to the research.

Intel has previously characterized this class of physical hardware research as "out of scope, but not out of mind." While Intel’s optional cryptographic-integrity mode successfully mitigates certain facets of the attack, the company is actively researching advanced memory-encryption paradigms for future silicon generations. One prominent proposal under consideration, known as cache-line versioning, aims to introduce bus-level freshness checks, though neither Intel nor independent researchers have confirmed whether such a mechanism would completely neutralize write-dropping methodologies.

Implications for Cloud Providers and Enterprise Security

DDRop highlights a fundamental engineering compromise inherent in current hardware-assisted confidential computing: balancing the immense performance and scalability requirements of enterprise cloud infrastructure against absolute cryptographic robustness. By scaling encryption across hundreds of gigabytes or terabytes of system memory, hardware designers intentionally bypassed freshness verification to avoid the severe performance penalties and massive hardware overhead associated with maintaining comprehensive cryptographic integrity trees.

Because the vulnerability stems from foundational hardware architecture rather than software implementation flaws, industry experts emphasize that there is no simple software patch available to eliminate the root cause. While cloud operators and hardware vendors can implement defensive hardening measures—such as restricting specific memory-management functionalities, introducing runtime validation checks for critical write sequences, and deploying physical intrusion-detection sensors within server chassis—these steps merely raise the operational barrier for an attacker rather than closing the underlying gap.

Major cloud hyperscalers, including Amazon Web Services (AWS), Microsoft Azure, and Google Cloud, rely heavily on Intel TDX, Scalable SGX, and AMD SEV-SNP to market secure, privacy-preserving infrastructure to enterprise customers handling sensitive financial, healthcare, and governmental data. While the researchers stressed there is no evidence indicating that DDRop has been deployed maliciously outside of a controlled laboratory environment, the disclosure underscores the persistent risk that sophisticated adversaries with localized physical access can bypass advanced hardware protections.