New DDRop Attack Breaks Intel TDX and AMD SEV-SNP With $159 DDR5 Device
DDRop uses a $159 DDR5 RDIMM interposer to silently drop memory writes and break Intel TDX and AMD SEV-SNP confidential VMs.
Researchers published DDRop, a physical attack built from about $159 in parts that uses a custom DDR5 RDIMM interposer to inject parity errors and silently discard selected cache-line writebacks. Intel TDX, Intel Scalable SGX, and AMD SEV-SNP are affected because they lack per-line cryptographic freshness, so processors can accept stale encrypted data as valid state. The team demonstrated deterministic plaintext copying between pages, malicious Secure EPT entry injection, forcing trust domains into debug mode, and forging attestation measurements. The attack requires privileged host control plus brief physical access, and researchers say no simple software patch exists.
- $159 DDR5 interposer injects parity errors to silently drop writes at native speed
- Intel TDX, Scalable SGX, and AMD SEV-SNP lack per-line freshness and accept stale data
- PoC shows debug-mode forcing, malicious SEPT injection, and forged attestation
- Requires physical server access and privileged host control, targeting cloud and colocation
- Durable fix needs hardware integrity plus freshness checks; no software-only patch
From the original article
3 min read at cybersecuritynews.com
Confidential cloud systems are designed to keep a customer’s data hidden even from the server operator. DDRop shows that this promise can fail when an attacker can tamper with the DDR5 memory path. The new technique is a physical hardware attack, not malware, but it can undermine workloads protected by Intel TDX and AMD SEV-SNP.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.