A circuit board that costs less than $200 can break the integrity protections of Intel and AMD’s confidential computing hardware, according to researchers from KU Leuven, ETH Zurich, Durham University and Google. Their attack, called DDRop, needs physical access to the server, which limits it mainly to cases where cloud providers promise tenants that even the provider can’t see their data.
“DDRop uses a custom-built ‘interposer’: a small, custom-designed circuit board, costing under $200, that sits between the processor and a memory module,” Jo Van Bulck, a professor in the DistriNet lab at KU Leuven, told The Register by email. “It corrupts commands on the high-speed DDR5 memory bus to silently drop writes to encrypted memory. The protected VM keeps computing on old data that still decrypts perfectly. We are releasing the complete interposer design as open-source hardware.”
The missing freshness check
Intel TDX, Scalable SGX and AMD SEV-SNP all rely on scalable memory encryption, which protects large amounts of RAM but doesn’t check whether the data in memory is fresh. According to the paper, the interposer injects targeted parity errors so that cache-line writebacks are silently discarded. The processor then reads back stale, attacker-chosen ciphertext that still decrypts correctly, opening the door to replay attacks.
“Scalable memory encryption deliberately trades cryptographic freshness (e.g., available in early Intel SGX offerings supporting only 128/256 MB of protected memory) for the ability to protect large amounts of memory in cloud systems,” Van Bulck said.
The team built an end-to-end proof of concept on a current Intel TDX server. “By injecting maliciously crafted secure page-table entries, we can force any protected VM into debug mode and read out its private memory in plaintext,” Van Bulck said. “Furthermore, writing to critical TDX metadata structures enables forged attestation reports, so that a backdoored VM appears trusted to the remote user.” Both attacks succeed deterministically in under two minutes without crashing the machine, he said.
Who could pull it off
The threat model assumes an attacker who already has root on the host and brief, one-time physical access, for example during routine maintenance, to install the interposer, which the researchers say takes a few minutes. Earlier DDR5 attacks such as TEE.fail were passive, used bulky logic analyzers and required slowing the memory bus. The same group’s Battering RAM attack worked on DDR4 using address aliasing that DDR5’s redesigned command bus blocks. Van Bulck said DDRop is the first active interposer attack on DDR5, runs at full speed, and costs far less than earlier interposition attacks that needed an estimated $170,000 in lab equipment.
He said there’s no simple software or hardware patch for the root cause, and that planned mitigations such as “cache line versioning” still appear vulnerable. The paper says timing-based interposer detection and API hardening could reduce the attack surface.
Intel and AMD: out of scope
Both vendors published advisories after coordinated disclosure on Sept. 14. Intel’s announcement says “the described scenarios fall outside Intel’s standard threat model for confidential computing deployments.” It is evaluating further hardening and detection, including Platform Owner Endorsements that would let remote parties establish who physically holds the hardware, and recommends restricting physical access, securing hardware supply chains, applying least privilege and staying current on updates.
AMD’s bulletin says the technique “relies on a physical attack against the memory bus, which falls outside the scope of the published threat model for SEV-SNP.” AMD doesn’t plan to assign a CVE or release mitigations. It lists EPYC 4004, 4005, 8004, 9004 and 9005 series processors and Instinct MI300A as affected.
The paper will be presented at ACM CCS 2026 in The Hague.
WebProNews is an iEntry Publication