A newly identified hardware-level exploit dubbed “DDRop” undermines memory protection in Intel and AMD’s flagship confidential computing technologies. By silently dropping certain write operations in a server’s memory, the attack tricks the processor into reading stale encrypted data—making the system believe it’s freshly written data when it isn’t. The attack targets environments secured with Intel TDX, Intel Scalable SGX, and AMD SEV-SNP.
What is DDRop & How It Works
Central to this exploit is a small, low-cost interposer—a physical circuit board inserted between the processor and the memory module. Constructed for under $200 and installable within minutes, it intercepts memory writes and causes them to be dropped, yet the processor remains unaware. Existing memory encryption systems verify that data is encrypted but do not confirm its “freshness,” allowing previously encrypted values to be reused without detection. DDRop exploits this design gap.
Breaking Trust Models: Intel TDX & AMD SEV-SNP
On Intel TDX, the researchers manipulated page table initialization by dropping writes meant to set up entries. These dropped writes left behind attacker-chosen data, allowing a malicious virtual machine to remap other VMs’ memory onto arbitrary physical addresses and to read or modify protected memory regions. The attack also demonstrated elevating a victim VM into debug mode and forging attestation, making a compromised VM appear trustworthy to external validators. These techniques were confirmed in TDX’s default “logical integrity” mode; the “cryptographic integrity” mode should block many of them—except for attestation forgery, which remains possible because it only requires modifying data within the attacker-controlled VM.
On the AMD SEV-SNP front, the damage is more limited. Researchers found that they could duplicate a victim page’s contents into another via dropped writes during AMD’s page relocation. However, methods like toggling debug mode and forging remote attestation seem specific to Intel TDX.
Scope, Limitations, and Mitigations
The exploit affects any hardware using scalable memory encryption without freshness assurance—this includes Intel TDX, Scalable SGX, and AMD SEV-SNP. Older systems like Intel’s Client SGX aren’t vulnerable because they employ integrity trees that detect reused or stale data. Hardware where memory is packaged internally, such as NVIDIA’s confidential GPUs, are also safe because an interposer cannot be inserted. ARM’s CCA hasn’t been tested yet but could potentially be at risk.
Because this attack requires ONLY brief physical access—enough to insert the interposer—and then software control, it could be carried out through supply-chain compromise, internal malfeasance at data centers, or law-enforcement seizure of hardware. There is, so far, no evidence that DDRop has been used outside controlled lab setups.
Why Fixing DDRop Isn’t Easy
DDRop strikes at a hardware flaw: existing memory encryption prioritizes performance over freshness verification. Fixing this will likely require redesigned encryption hardware that embeds integrity and freshness checks. In the interim, software workarounds may help: limiting features that DDRop exploits, verifying that key writes have landed correctly, or detecting interposers at boot time.
AMD and Intel were alerted ahead of public disclosure. Both acknowledged the finding, but neither supplied immediate fixes or timelines. Intel has pointed to its optional cryptographic integrity mode—which blocks many attacks of this kind—as a partial mitigation. AMD has emphasized that physical attacks are outside the threat model for SEV/SNP. Neither company plans to assign a formal CVE for DDRop at this time.
Though hardware-based confidentiality and encryption have made strides in securing cloud instances against software threats, DDRop reveals a critical blind spot: without freshness checks, old encrypted data can be repurposed to breach integrity. As cloud providers accelerate deployment of confidential computing, ensuring that entire memory paths—including write operations—are protected becomes essential. Organizations using Intel TDX or AMD SEV-SNP need to assess risk—especially around supply chain or physical access—and push for hardware that closes this gap. Watch for updates from Intel and AMD, and for new processor designs incorporating freshness or integrity mechanisms to prevent next-gen DDRop-like threats.
