DDRop Hardware Attack Exploits Stale Memory Writes in Intel and AMD Confidential Computing

Sep 14, 2026 · Original article ↗

Summary

Researchers say DDRop uses a physical memory interposer to drop writes and bypass freshness protections in Intel TDX, Scalable SGX, and AMD SEV-SNP. It requires software control and brief physical access; no simple patch is available.

Key points

DDRop exploits the lack of freshness checks in scalable memory encryption: dropped writes leave stale encrypted data that processors accept as current.
The attack requires software control of a server and brief physical access to install an interposer; researchers estimate parts cost about $159.
On Intel TDX, researchers demonstrated reading victim memory, enabling debug mode, and forging a virtual machine’s launch measurement. Some results were shown only in the default logical-integrity mode.
On AMD SEV-SNP, researchers demonstrated copying one victim page into another through page relocation; the TDX debug-mode and attestation attacks do not apply.
Intel SGX’s older client version is not affected, according to the article, and confidential-computing GPUs with memory inside the chip package are out of reach. Arm CCA was not tested.
Researchers say there is no simple patch; software restrictions and checks may raise the bar, while a lasting fix would require memory-encryption hardware with integrity and freshness protections.
Researchers reported no evidence of DDRop or a comparable active interposer being used outside a laboratory; the attack does not show that cloud services have been breached.

Article Details

Attack Vectors: An attacker with software control and brief physical access inserts an interposer between the processor and a DDR5 memory module. The interposer drops selected memory writes, causing stale encrypted data to be read as current.
On Intel TDX, dropped writes during page-table setup can leave attacker-chosen entries in memory, enabling an attacker-controlled virtual machine to map memory to physical addresses and read or modify protected memory.
On Intel TDX, researchers demonstrated reading a victim virtual machine’s memory, switching it into debug mode to copy plaintext memory, and altering a launch measurement to forge attestation. The researchers could not confirm the attestation attack under cryptographic-integrity mode.
On AMD SEV-SNP, researchers demonstrated copying one victim page into another by dropping writes during page relocation.
Defensive Notes: The researchers say there is no simple patch because the weakness is in hardware design; closing it would require memory-encryption hardware that provides integrity and freshness checks.
Potential software measures include restricting the memory-management features abused by DDRop, checking that important writes completed, and checking for an interposer during boot.
Intel’s optional cryptographic-integrity mode blocks the demonstrated TDX victim-memory reading and debug-mode attacks, according to the researchers; they could not test whether it blocks the attestation-forgery attack.
The researchers say they have no evidence that DDRop or a comparable active interposer has been used outside a laboratory.

MITRE ATT&CK

T1200 · Hardware AdditionsThe attack requires inserting a hardware interposer between the processor and a memory module to drop memory writes.

Vendors

AMDResearchers disclosed DDRop, a cheap hardware attack that silently drops memory writes to break confidentiality and integrity protections in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP.IntelResearchers disclosed DDRop, a cheap hardware attack that silently drops memory writes to break confidentiality and integrity protections in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP.

Products

AMD SEV-SNPResearchers disclosed DDRop, a cheap hardware attack that silently drops memory writes to break confidentiality and integrity protections in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP.Intel Scalable SGXResearchers disclosed DDRop, a cheap hardware attack that silently drops memory writes to break confidentiality and integrity protections in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP.Intel TDXResearchers disclosed DDRop, a cheap hardware attack that silently drops memory writes to break confidentiality and integrity protections in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP.