New Hardware Attack Bypasses Intel and AMD Security

Researchers have identified a new hardware vulnerability that undermines the security guarantees of leading cloud encryption systems. The technique, known as DDRop, allows an attacker to manipulate how a server handles data without triggering any alarms, effectively breaking the protection offered by Intel TDX and AMD SEV-SNP.

The threat is not theoretical but relies on a physical intervention that requires prior control of the server software and brief access to the hardware. By inserting a small, inexpensive circuit board between the processor and memory, an attacker can force the system to ignore specific updates, leaving stale data in place while the machine believes it is processing fresh information.

Low-Cost Component Disrupts Memory Writes

The attack utilizes a device called an interposer, which costs less than $200 to build. This small board sits on the memory bus and operates at full speed, specifically targeting the DDR5 standard used in modern servers. Unlike previous passive attacks that merely listened to data traffic, this method actively alters what the memory module receives.

The interposer works by forcing an error signal onto the command bus and simultaneously cutting the wire that allows the memory module to report that error. As a result, the memory module silently discards the write command, and the processor remains unaware that the update never happened. The encryption engine continues to function normally, detecting no corruption or tampering.

Gap in Encryption Freshness Exploited

Confidential computing designs keep server memory encrypted to protect data from physical inspection. However, these systems prioritize encryption over verifying that data is current. They can confirm that memory is scrambled but cannot guarantee that the scrambled data reflects the latest written value. DDRop exploits this specific omission, allowing old encrypted data to be read as if it were the most recent state.

This approach distinguishes itself from earlier attacks like TEE.fail, which were passive and required slowing down the memory bus. It also bypasses the limitations of active attacks on older DDR4 memory, such as Battering RAM, which relied on address-swapping tricks blocked by the newer DDR5 command format. By dropping writes instead of swapping addresses, DDRop remains effective on the latest hardware.

Full Control Over Virtual Machines

The practical impact is severe, particularly for Intel TDX systems. Researchers demonstrated that by dropping writes to page tables, they could map their own virtual machine onto any physical address. This allowed them to read the private memory of other virtual machines and even switch a victim machine into debug mode to copy data in plaintext.

More alarmingly, the team showed how to overwrite the launch measurement used by a virtual machine to prove its trusted state to customers. This allows an attacker-controlled machine to pass security checks as if it were legitimate. While TDX's stronger cryptographic integrity mode blocks some of these actions, the ability to forge attestation remains a critical risk. The findings, reported by The Hacker News, highlight a significant trade-off in current cloud security architectures.