DDRop Attack Breaks Confidential Computing on Intel TDX and AMD SEV-SNP

Researchers from KU Leuven, ETH Zurich, Durham University, and Google have disclosed DDRop, a new active hardware attack that defeats the memory integrity guarantees of Intel TDX, Intel Scalable SGX, and AMD SEV-SNP — the confidential computing technologies cloud providers use to isolate customer workloads from the underlying host. By silently dropping writes to a server's DDR5 memory through a custom interposer board that costs under $200 to build, the attack causes processors to read stale encrypted data as if it were current, breaking the integrity foundation of modern trusted execution environments (TEEs). The work is scheduled for presentation at ACM CCS 2026 in November, alongside the release of the interposer schematics, controller firmware, and exploit code on GitHub.

DDRop weaponizes the absence of a "freshness" guarantee in current confidential-computing designs. While these architectures encrypt memory and validate ciphertext integrity, they cannot confirm that a location actually holds the most recently written value — meaning older encrypted data still decrypts cleanly. The interposer sits on the memory bus between the processor and a DIMM; to drop a write, it injects a fault on the DDR5 command bus and simultaneously disables the module's error-reporting line, suppressing the failure so the encryption engine sees no anomaly. The processor then happily decrypts whatever was previously stored at that address.

The attack is significant as the first active interposer exploit demonstrated against DDR5 in production cloud servers, and the first to break the integrity of a fully updated Intel TDX deployment rather than merely eavesdropping on it. Earlier passive work such as TEE.fail required slowing the memory bus to interoperate with repurposed lab equipment, while prior active attacks like Battering RAM targeted DDR4 only — DDR5's redesigned command format blocks the address-swapping technique those exploits relied upon. DDRop sidesteps that barrier by dropping writes entirely, and its interposer runs at full DDR5 speed using commodity switching hardware.

Against Intel TDX specifically, the team escalated write-dropping into full control of a protected virtual machine by targeting the encrypted page-table initialization sequence: when trusted firmware writes empty entries to set up a new page table, DDRop drops those writes, causing the structure to retain attacker-prepared data planted beforehand. With hyperscalers and enterprises increasingly trusting TEEs to safeguard sensitive workloads, the research underscores that physical-access adversaries remain a credible threat class for even the newest confidential-computing silicon. Defenders should track vendor mitigations closely; in the meantime, an privacy checkup can help teams audit their broader exposure, while an SSL/TLS checker and email breach checker support baseline hardening against adjacent threats.