New DDRop Attack Breaks Intel TDX and AMD SEV-SNP With $159 DDR5 Device

Confidential cloud systems are designed to keep a customer’s data hidden even from the server operator. DDRop shows that this promise can fail when an attacker can tamper with the DDR5 memory path.

The new technique is a physical hardware attack, not malware, but it can undermine workloads protected by Intel TDX and AMD SEV-SNP.

Earlier work had already raised questions about trust boundaries in confidential virtual machines. In earlier TDX isolation findings, researchers showed that a hostile virtual-machine manager could observe activity patterns inside a protected trust domain.

DDRop moves the concern below software, targeting memory commands travelling between a processor and server memory.

Researchers behind the published GitHub research materials said in a report shared with Cyber Security News (CSN) that DDRop uses a custom DDR5 registered DIMM interposer to interfere with memory writes at normal operating speeds.

The project includes hardware designs, controller firmware, host tools, and proof-of-concept attack code for the affected platforms. The attack requires privileged control of the target host and brief physical access to install the device.

That makes it less likely to affect ordinary endpoint users, but it creates a serious risk model for cloud infrastructure, colocation facilities, and other environments where attackers may access servers during maintenance or supply-chain handling.

New DDRop Attack Breaks Intel TDX

The researchers built the interposer for $159 in parts, excluding development time and assembly costs. It sits between the CPU and a DDR5 RDIMM, then manipulates command signals instead of reading ordinary application data.

The design can trigger parity failures, causing the memory module to reject selected write commands while the system is not properly alerted.

When a write is silently discarded, a protected virtual machine can later read older data that should have been replaced. This is the core DDRop primitive.

The researchers found that Intel TDX, Intel Scalable SGX, and AMD SEV-SNP can be affected because scalable memory-encryption designs do not fully verify whether encrypted memory contains the freshest version of each cache line.

That distinction matters. Encryption can keep a memory value unreadable to an attacker, yet it does not necessarily prove the value is current.

Similar lower-level risks were highlighted in recent DRAM scrambling analysis, where researchers examined how changes beneath the operating system can bypass controls that assume memory addresses remain stable.

TDX and SEV-SNP Security Impact

DDRop becomes more damaging when it is combined with trusted memory-management interfaces exposed to a malicious host. The researchers showed that an attacker could interfere with page relocation and force a destination page to retain stale contents.

In testing, this enabled deterministic copying of plaintext between pages belonging to the same confidential virtual machine. On Intel TDX, the team also demonstrated injection of malicious Secure Extended Page Table entries.

This can give an attacker control over protected address translations, opening a route to victim ciphertext access, replay attacks, and corruption of sensitive control structures.

The researchers further showed attacks that could place a trust domain into debug mode or forge an expected attestation measurement. The most durable fix requires hardware designs that provide both cryptographic integrity and freshness checks, the researchers said.

Until then, organizations should limit physical access to servers, monitor firmware and memory configuration changes, use attestation carefully, and disable memory-management features that are not required.

Broader AI data center hardening practices, including firmware baselines and hardware inventory controls, can also help reduce exposure to physical platform attacks.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.