Researchers Uncover DDRop: A Novel Hardware Attack Breaking Confidential Computing Memory Protection in Intel and AMD Servers

A team of academic and industry researchers has disclosed a sophisticated hardware attack known as DDRop, which successfully bypasses the cryptographic memory protections safeguarding modern cloud servers. By silently dropping write operations directed at server memory, the attack forces processors to continuously read stale, encrypted data as if it were current and valid. This vulnerability exposes a fundamental architectural limitation in current cloud security models, impacting major confidential computing frameworks deployed by industry giants such as Amazon Web Services, Microsoft Azure, and Google Cloud.

The discovery highlights an inherent trade-off in contemporary server design. To efficiently secure massive pools of server memory, hardware manufacturers have historically omitted memory freshness guarantees—mechanisms that verify whether retrieved data represents the most recently written value. While confidential computing ensures data remains encrypted while in use to shield workloads from rogue cloud providers, the absence of a freshness check leaves the system open to targeted hardware manipulation.

An Overview of the DDRop Mechanism

DDRop relies on the integration of a custom-built circuit board known as an interposer. Crafted for under $200 in raw components—specifically estimated at roughly $159—this compact device is physically inserted between the host processor and a DDR5 memory module during a brief period of physical access. Once installed, the interposer operates seamlessly at full DDR5 speeds, orchestrating precise disruptions on the memory bus.

Rather than intercepting or modifying data packets in transit, the interposer forces a calculated command error on the memory bus and simultaneously severs the wire utilized by the memory module to report that error. Consequently, the memory module quietly discards the command, while the processor remains entirely unaware that the write operation failed. Because the encryption engine detects no anomalous decryption faults, the processor simply falls back to reading the pre-existing encrypted data residing in the physical address space.

Unlike earlier passive interposer attacks—such as TEE.fail, which relied on slower, secondary lab equipment to monitor memory buses—DDRop is an active, high-speed exploit optimized for modern DDR5 hardware. Furthermore, while previous active exploits like Battering RAM were constrained to older DDR4 architectures due to specific address-swapping requirements, DDRop circumvents these limitations entirely by adopting a write-dropping paradigm.

Chronology and Coordinated Disclosure

The vulnerability is the culmination of collaborative research involving specialists from KU Leuven, ETH Zurich, Durham University, and Google. The team plans to formally present its comprehensive findings in November at the ACM CCS 2026 conference. In keeping with responsible disclosure practices, the researchers notified both Intel and AMD in advance, allowing the hardware manufacturers time to prepare advisories ahead of public disclosure.

To foster academic and defensive review, the research group has committed to publishing the interposer’s physical board designs, controller firmware, and proof-of-concept attack code on GitHub, alongside their detailed research paper hosted on the official DDRop project domain. Intel and AMD are scheduled to release their respective security bulletins addressing the disclosure, while academic observers continue to analyze the broader systemic ramifications for enterprise infrastructure.

Exploiting Intel TDX and AMD SEV-SNP

The practical implications of DDRop vary depending on the specific confidential computing architecture targeted. On systems running Intel Trusted Domain Extensions (TDX), the researchers demonstrated that write-dropping could be leveraged to achieve complete control over a protected virtual machine.

Intel TDX relies on trusted firmware to maintain encrypted page tables for individual virtual machines. When this firmware attempts to initialize empty entries for a newly provisioned page table, DDRop intercepts and drops the write commands. As a result, the system retains attacker-selected data previously left in that specific memory region. This manipulation enables a malicious virtual machine to map its own memory space onto arbitrary physical addresses, granting unrestricted read and write capabilities over protected memory zones.

Utilizing this privileged access, the researchers successfully extracted private memory from a victim virtual machine and forced the target machine into a debugging state. This maneuver allowed them to duplicate sensitive memory contents in plaintext before restoring the original data, leaving no discernible forensic traces of tampering. Additionally, the team demonstrated the capability to manipulate launch measurements—the cryptographic hashes virtual machines use to verify their integrity to remote users—potentially allowing an unauthorized instance to pass remote attestation checks as a legitimate, trusted workload.

While certain advanced exploits like memory extraction and debug-mode toggling were tested under TDX’s default logical integrity mode, the researchers noted that TDX’s optional cryptographic integrity mode would theoretically block direct data cross-contamination between virtual machines. However, they caution that generating forged attestation measurements would likely remain feasible even under stronger integrity modes, as such write operations occur locally within the attacker’s isolated virtual machine space under its own distinct keys.

In contrast, the impact on AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) was observed to be more constrained. By dropping writes during AMD’s page-relocation operations, researchers successfully copied the contents of one victim memory page into another. However, the advanced debug-mode and attestation-forgery techniques deployed against Intel remain specific to the TDX architecture. Other frameworks, such as NVIDIA’s confidential-computing GPUs, remain structurally protected because their memory is housed directly inside the processor package, precluding the physical installation of an interposer.

Industry Response and the Challenge of Patching

The discovery of DDRop has reignited debate within the semiconductor industry regarding the scope of threat models for physical server security. Both Intel and AMD have maintained that attacks requiring physical access to hardware fall outside the defined security boundaries of their respective server architectures.

In official statements, AMD noted that because the methodology requires physical intervention, it remains outside the scope of the published threat model for SEV and SEV-SNP. Intel has similarly asserted that physical interposer attacks fall outside the protective guarantees offered by its memory encryption frameworks, indicating that it does not plan to issue Common Vulnerabilities and Exposures (CVE) identifiers for this class of physical hardware manipulation.

Nevertheless, Intel characterized the research area as "out of scope, but not out of mind." The company currently offers an optional cryptographic integrity mode on select modern Xeon processors that mitigates specific facets of the attack, and engineering teams are actively evaluating enhanced memory-encryption paradigms for future silicon generations. Among these proposals is cache-line versioning, a conceptual mechanism designed to integrate freshness checks directly onto the memory bus, though neither manufacturer has confirmed whether such designs would completely neutralize interposer-based write-dropping.

Implications for Enterprise Cloud Environments

Because DDRop targets the underlying hardware specifications of DDR5 memory rather than software flaws, implementing a straightforward software patch is technically unfeasible. The vulnerability stems from a fundamental engineering compromise: sacrificing memory freshness verification to accommodate the vast performance and capacity demands of modern cloud infrastructure.

Security analysts emphasize that while the threat vector requires physical proximity—such as access via a compromised data center environment, supply chain tampering, or malicious insider activity—the low cost and rapid deployment time of the interposer present distinct challenges for high-security data centers. Organizations utilizing confidential computing rely on these hardware boundaries to protect sensitive financial, governmental, and personal data from unauthorized inspection, even by entities administering the physical infrastructure.

As cloud providers and hardware vendors continue to refine their security postures, the DDRop disclosure underscores the ongoing cat-and-mouse dynamic between hardware designers and security researchers, signaling an eventual industry-wide shift toward integrating robust memory freshness verification into upcoming generations of server hardware.