New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
DDRop is a new hardware attack that silently drops memory writes in Intel TDX and AMD SEV-SNP confidential computing systems by using a cheap ($200) interposer board placed between the processor and DDR5 memory modules The attack exploits a fundamental design gap: confidential computing encrypts memory but omits a "freshness" guarantee, meaning the processor cannot verify whether memory holds the latest written value or stale data DDRop is the first active interposer attack to work on DDR5 memor
Analysis
TL;DR
- DDRop is a new hardware attack that silently drops memory writes in Intel TDX and AMD SEV-SNP confidential computing systems by using a cheap ($200) interposer board placed between the processor and DDR5 memory modules
- The attack exploits a fundamental design gap: confidential computing encrypts memory but omits a "freshness" guarantee, meaning the processor cannot verify whether memory holds the latest written value or stale data
- DDRop is the first active interposer attack to work on DDR5 memory, overcoming limitations of prior passive attacks (TEE.fail) and DDR4-only active attacks (Battering RAM) by dropping writes instead of swapping addresses
- On Intel TDX, the attack enables full VM control including reading victim memory, toggling debug mode, and forging attestation measurements; on AMD SEV-SNP, it allows copying victim page contents via write dropping during page relocation
- There is no simple software patch—the vulnerability is inherent in hardware design, and resolving it would require new memory-encryption hardware that provides both integrity and freshness checks
Why It Matters
This attack fundamentally undermines the trust model of confidential computing, which is increasingly adopted by major cloud providers (AWS, Microsoft Azure, Google Cloud) to protect customer workloads. It demonstrates that hardware-level security guarantees can be broken with relatively inexpensive physical access, raising serious concerns for multi-tenant cloud environments where physical infrastructure security is paramount.
Technical Details
- Attack mechanism: An interposer board with switches sits on the DDR5 memory bus and runs at full speed. To drop a write, it forces an error on the command bus and severs the error-reporting wire, causing the memory module to silently discard the command while the processor remains unaware
- Targeted technologies: Intel TDX (both logical and cryptographic integrity modes), Intel Scalable SGX, and AMD SEV-SNP—all of which encrypt memory but lack freshness verification for large-scale server memory
- Key technical breakthrough: Unlike prior DDR5 attacks that were passive and required slowing the bus, DDRop is an active attack that works at full DDR5 speed by exploiting the write-dropping approach, which bypasses DDR5's redesigned command format that blocked earlier address-swapping techniques
- Demonstrated exploits on Intel TDX: (1) Dropping writes during page table initialization allows an attacker's VM to map onto any physical address, (2) reading victim VM private memory, (3) toggling debug mode to copy plaintext memory and restore original data invisibly, (4) forging launch measurements for remote attestation
- Limitations and scope: NVIDIA confidential-computing GPUs are unaffected (memory is inside the chip package); Arm CCA is untested but potentially vulnerable; the older Intel Client SGX is protected by a hardware integrity tree; no evidence of real-world deployment outside laboratories
Industry Insight
- Cloud providers offering confidential computing must reassess their physical security assumptions and consider architectural mitigations such as mandatory cryptographic integrity modes, periodic memory freshness checks, or hardware-level freshness guarantees in future processor designs
- Organizations relying on TDX or SEV-SNP for compliance and data protection should evaluate whether their current configurations (e.g., TDX's default logical integrity mode) are sufficient, and prioritize enabling stronger integrity modes where available
- The open-sourcing of interposer designs, firmware, and attack code on GitHub lowers the barrier to replication, prompting the industry to accelerate hardware-level fixes and potentially reconsider the trade-off between scalability and freshness in memory encryption schemes
Disclaimer: The above content is generated by AI and is for reference only.