DDRop Attack Breaks Intel and AMD Confidential Computing Protections

Researchers have disclosed a new hardware-based attack, named DDRop, which can compromise the memory protections used in Intel and AMD confidential computing technologies.

The attack targets Intel TDX (Trust Domain Extensions), Intel Scalable SGX, and AMD SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging), which are the hardware technologies employed by major cloud providers to protect customer data while it is being processed. By using a low-cost hardware interposer, attackers can bypass encryption by preventing the processor from receiving updated data, effectively forcing it to rely on stale, encrypted values.

The DDRop Mechanism

DDRop exploits a design gap in current DDR5 memory encryption. While these systems ensure that memory remains encrypted, they often omit a freshness guarantee to maintain performance across large volumes of data. This means the processor can verify that memory is encrypted, but cannot always confirm that the data it is reading is the most recent version written to the module.

The attack requires an adversary with physical access to the server to insert a small, specialised circuit board, known as an interposer, between the processor and the memory module. This interposer, which researchers estimate can be built for approximately $159, sits on the memory bus and functions by forcing errors on the command bus and then suppressing the error reports. This causes the memory module to silently discard write commands, leaving the old data in place for the processor to read back.

Impact on Cloud Environments

The research, conducted by a team from KU Leuven, ETH Zurich, Durham University, and Google, demonstrates significant security breaches on Intel TDX systems. The researchers successfully used DDRop to read the private memory of a victim virtual machine, switch a machine into debug mode to copy plaintext memory, and overwrite launch measurements used for attestation.

On AMD SEV-SNP, the researchers were able to use write-dropping during page-relocation to copy the contents of one victim page into another. While the impact on AMD was more limited, the underlying vulnerability, caused by the lack of a freshness check, affects all three targeted technologies.

Vendor Responses and Mitigation

Intel and AMD have acknowledged the research through coordinated disclosure. AMD stated that because the attack necessitates physical access to the hardware, it falls outside the defined threat model for SEV-SNP. Intel similarly noted that physical interposer attacks are considered outside the protection scope of its current memory encryption, though it described the research as “out of scope, but not out of mind.”

There is currently no simple software patch to resolve the vulnerability, as the issue resides in the hardware design itself. Closing the gap would require future memory-encryption hardware that integrates both integrity and freshness checks. Intel has proposed cache-line versioning for future chips to address these issues, though it remains unconfirmed if this will fully mitigate DDRop-style attacks.