DDRop exposes a fresh fault line in confidential computing

A newly disclosed hardware attack called DDRop targets the memory-protection machinery used by confidential-computing systems from Intel and AMD. The researchers say a small interposer fitted to a server's DDR5 memory bus can silently drop writes, leaving older encrypted data in place while the processor treats it as current. That matters because confidential computing is meant to protect workloads even from the cloud provider operating the machine.

Watch Desk analysis

What happened

The Hacker News reports that researchers from KU Leuven, ETH Zurich, Durham University and Google demonstrated DDRop against Intel TDX, Intel Scalable SGX and AMD SEV-SNP. The attack needs an adversary who already controls software on the server and can briefly access the hardware. The interposer costs about $159 in parts, according to the researchers, and is driven in software once installed.

On Intel TDX, the team says it could use dropped writes to map an attacker's memory over protected addresses, read a victim virtual machine's private memory, switch a victim into debug mode and alter the measurement used for remote attestation. The researchers say some of those results depend on TDX's default logical-integrity mode. Its optional cryptographic-integrity mode would block some cross-VM attacks, but they argue that it still does not add the freshness check needed to detect reused old data. They could not confirm every result on that mode because their test system did not support it.

On AMD SEV-SNP, the reported result is narrower: dropping writes during page relocation let the researchers copy one victim page into another. Intel Client SGX is described as protected by a hardware integrity tree, while NVIDIA's confidential-computing GPUs are outside the attack's reach because their memory is inside the chip package. The researchers say Arm CCA may also be affected, but they did not test it.

Who is affected

• Intel TDX
  Researchers report memory-disclosure, debug-mode and attestation-related attacks, with some results depending on the integrity mode.
• AMD SEV-SNP
  The demonstrated effect is narrower, involving page relocation and copying one victim page into another.
• Cloud confidential computing
  TDX and SEV-SNP are offered by major cloud platforms, so the finding concerns the hardware assumptions behind protected workloads, not a confirmed breach of a named service.
• Physical-access attackers
  DDRop requires server-software control plus a short opportunity to fit hardware, making rogue insiders, supply-chain tampering and seized equipment more plausible scenarios than a remote internet attack.

Why it matters

The awkward detail is architectural. Large-scale memory encryption can protect confidentiality without proving that each value is the newest one. DDRop turns that missing freshness guarantee into a way to make stale encrypted data look valid.

The researchers say closing the gap properly would require new memory-encryption hardware that provides both integrity and freshness. Software controls, restrictions on abused memory-management features and interposer detection may reduce exposure, but they do not erase the underlying design trade-off. Intel and AMD were told in advance; the evidence says AMD planned a bulletin for 14 September, while Intel had not responded to The Hacker News before publication.

Our read

This is a serious security disclosure with a narrow but important threat model. It does not show that AWS, Azure or Google Cloud has been broken into, and the researchers report no evidence of real-world use. It does show that confidential computing's protection story depends on physical and hardware assumptions that deserve more scrutiny than a reassuring encryption label usually receives.

Cloud operators and hardware teams should read the forthcoming vendor guidance, check which integrity modes and memory-management features they actually use, and treat physical access to servers as part of the threat model rather than a footnote.

What to watch

• AMD's product-security bulletin and any Intel advisory or mitigation guidance.
• Whether cloud providers describe affected configurations or operational protections.
• Independent testing of DDRop against TDX cryptographic-integrity mode and other confidential-computing designs.
• Whether proposed freshness mechanisms, including Intel's cache-line-versioning work, demonstrably stop the attack.

Discussion spark: Should confidential-computing providers treat brief physical access as a first-class cloud threat, or is DDRop best understood as outside the practical service model?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.