Researchers from KU Leuven, ETH Zurich, Durham University, and Google have demonstrated DDRop, a hardware attack that defeats the memory protections in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP — the confidential computing technologies that cloud services use to keep customer data private even from the hosting provider. The attack requires brief physical access to the server to insert a small circuit board, called an interposer, between the processor and a memory module. The interposer costs roughly $159 in parts and operates at full DDR5 speed. Once in place, it can be driven entirely from software without requiring further physical contact.
The root cause is a deliberate design trade-off. All three technologies encrypt server memory but skip a property called freshness — they can verify that memory is encrypted but not that it contains the latest written value. DDRop exploits this gap by forcing the memory module to silently discard write commands. The processor, seeing no error, reads back old encrypted data as if the update had occurred. On Intel TDX, the researchers used this technique to gain full control of a protected virtual machine, read a victim VM’s private memory, toggle its debug mode, and forge the attestation measurement that customers use to verify a VM started in a trusted state. On AMD SEV-SNP the impact is narrower — the team demonstrated the ability to copy one victim page’s contents into another, but not the debug or attestation attacks. Both Intel and AMD have said that physical attacks against server memory fall outside the published threat model for their respective technologies, and neither will assign a CVE. Intel’s optional cryptographic-integrity mode, available on some current Xeon processors, blocks the victim-memory-read and debug-mode attacks, but the researchers believe attestation forgery would still succeed under that mode. The research is scheduled for presentation at ACM CCS 2026 in November, and the team has released interposer board designs, firmware, and attack code on GitHub.