Researchers at KU Leuven, ETH Zurich, Durham University and Google have disclosed DDRop, a hardware attack that breaks the memory protection used by Intel and AMD confidential computing by silently dropping writes to a server's memory, so the processor keeps reading stale encrypted data as though the update had happened. The attack requires an adversary who already controls the server's software and can briefly access the machine to insert a small circuit board — an interposer costing under US$200 to build — between the processor and a memory module; the board forces an error on the command bus and then cuts the wire the module uses to report that error, so the write is quietly discarded and the processor is never told. DDRop works against Intel TDX, Intel Scalable SGX and AMD SEV-SNP, the hardware cloud providers offer to keep customer workloads private from the provider itself. The underlying weakness is architectural rather than a coding error: these designs encrypt memory but omit a freshness guarantee, so the processor can confirm that memory is encrypted but not that it holds the latest written value, and old ciphertext still decrypts correctly. On Intel TDX the researchers turned write-dropping into full control of a protected virtual machine — dropping trusted firmware's writes of empty page-table entries so the table retains attacker-chosen data, mapping the attacker's own VM onto arbitrary physical addresses, reading a victim VM's private memory, switching a victim machine into debug mode and copying its memory in plaintext, and overwriting the launch measurement a VM uses to prove to a remote customer that it started in a known trusted state. They characterise the result as the first active interposer attack against the DDR5 memory in current cloud servers and the first to break the integrity of an up-to-date Intel TDX system rather than merely read from it, distinguishing it from the passive TEE.fail approach and from Battering RAM, which required DDR4. Their test system did not support TDX's stronger cryptographic-integrity mode, which they assess would block the memory-reading and debug-mode results but not the attestation forgery, because that write happens inside the attacker's own VM under its own key; AMD SEV-SNP gives a narrower result, copying one victim page into another during page relocation. NVIDIA's confidential-computing GPUs are out of reach because their memory sits inside the chip package, Arm's CCA was not tested, and the older Intel Client SGX uses a hardware integrity tree that catches stale data. There is no simple patch. The work is due to be presented at ACM CCS 2026 in November, with board designs, controller firmware and attack code to be released on GitHub, and the researchers told The Hacker News they have no evidence of the attack or a comparable active interposer being used outside a laboratory — no cloud service has been shown to be broken into.

• Source article