DDRop: $159 interposer board breaks memory freshness in Intel TDX and AMD SEV-SNP

A paper disclosed this month by researchers from KU Leuven, ETH Zurich, Durham University and Google describes an attack that undermines the central promise of confidential computing on Intel TDX and AMD SEV-SNP servers: that a customer's data remains protected even from the provider operating the machine. According to a write-up on dev.to, which draws on reporting from The Hacker News and SC World, the attack — named DDRop — relies on a circuit board that costs roughly $159 to build.

The gap: encryption without freshness

Confidential computing features encrypt a server's DRAM while workloads run, so anyone with physical access to the machine reads only ciphertext. But to cover the very large memory footprint of a cloud server, these designs verify only that memory contents are correctly encrypted. As the dev.to write-up explains, they omit a guarantee known as freshness: nothing confirms that the value sitting in memory is the most recent one the CPU wrote. That omission is the opening the researchers exploited.

How the interposer works

The team built a small interposer board that sits between the CPU and the DDR5 memory modules and silently discards selected write commands. When a write is dropped, the earlier value stays in memory, and the processor later reads that stale value back under the assumption its update had been applied. Because the stored data is still properly encrypted, the memory encryption engine has no signal that anything went wrong — the hardware checks encryption correctness, not recency.

From stale data to full VM compromise

The consequences extend well beyond information leakage. According to the write-up, the researchers demonstrated full control over protected virtual machines on Intel TDX by manipulating page table writes, which in turn enables unauthorized memory access. More significantly, the technique allows attestation forgery: a VM that has been tampered with can still produce evidence claiming it is running genuine, unmodified code. Attestation is the mechanism customers depend on to trust a confidential VM in the first place, so attacking it strikes at the root of the trust model. AMD's SEV-SNP is named alongside TDX as sharing the missing-freshness weakness, though the full-VM-control demonstration described in the write-up was performed on Intel TDX.

What the attack requires

DDRop is not a remote exploit. The write-up notes that it presumes an attacker who already controls the host's software and can obtain brief physical access to install the board. Intel and AMD acknowledged the disclosure but stated that attacks requiring physical access sit outside the threat models their confidential computing features are designed against. The dev.to author argues this position is technically defensible yet sits uneasily beside the pitch that drew many customers in the first place: protection from a malicious insider with access to the server.

No straightforward fix

Because the weakness is architectural — a property of how these CPUs manage memory rather than a flaw in code — the write-up states that a simple software patch is not feasible. The vulnerability exists at the hardware level, which rules out the usual remediation cycle of shipping an update and moving on.

Why it matters

Confidential computing is marketed as the answer to a pointed question: what if the provider itself, or an insider with both credentials and hands-on access, is the adversary? DDRop shows that the answer currently rests on a guarantee — memory freshness — that mainstream server CPUs deliberately skipped to keep encryption coverage manageable across a cloud server's memory. For roughly $159 in parts plus a short window of physical access, an attacker who already controls the host can make a protected VM misrepresent its own integrity, and the platform's own checks will not raise an alarm. Organizations running sensitive workloads on TDX or SEV-SNP should map this result against their threat model: if physical access by provider staff is a scenario they care about, the protection on offer is narrower than the messaging suggests, and a fix will not arrive as an ordinary patch.