Security researchers have found a way to defeat the memory protections that Intel and AMD sell to cloud customers as their last line of defense against an untrusted host. The tool required costs less than a decent pair of headphones.
A team from KU Leuven, ETH Zurich, Durham University, and Google published details Sunday of an attack called DDRop, which exploits a fundamental design flaw in the memory encryption hardware powering confidential computing services at Amazon, Microsoft, and Google. It breaks protections in Intel Trust Domain Extensions (TDX), Intel Scalable SGX, and AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP), the three technologies that allow cloud customers to run workloads that even the cloud provider cannot read.
The method does not require a software exploit. It requires a small custom-built circuit board, a brief window of physical access to the server, and knowledge of how DDR5 memory commands work. The researchers built their device for $159 in parts.
The Gap Nobody Patched
Confidential computing encrypts a server's working memory at all times. Even a cloud provider's own administrator sees only scrambled data. The problem DDRop exposes is that encryption is not the same thing as freshness. The processor can confirm that data in memory is encrypted. It cannot confirm that data is current. Stale data, so long as it was encrypted legitimately at some point in the past, will still decrypt correctly and raise no alarm.
DDRop turns that gap into an attack. A small interposer board sits between the processor and a DDR5 memory module. When the attacker wants to cancel a specific memory write, the interposer forces a parity error on the command bus. The memory module silently discards the write. The interposer then cuts the wire used to report that error, so the processor is never notified. Old data stays in memory. The system has no way to know the latest update never arrived.
This is the first active interposer attack to run on DDR5 at full bus speed. Earlier DDR5 research required slowing the memory bus down and could only listen passively. Previous active attacks that altered memory contents only worked on older DDR4 hardware, DDR5's redesigned command format blocked them. DDRop routes around that entirely by dropping writes rather than redirecting them.
What the Researchers Pulled Off
On an Intel TDX server, the team demonstrated four outcomes. By dropping writes to page tables during setup, they mapped an attacker's virtual machine onto any physical memory address, then read a victim machine's private memory in full. They also flipped a victim machine into debug mode, copied its memory in plaintext, and restored everything afterward with no trace of tampering.
The most consequential result was attestation forgery. Attestation is the mechanism a hospital or bank uses to verify that the virtual machine handling their data is the one they approved and has not been altered. With DDRop, an attacker's machine can pass that check as though it were a trusted one. A customer could be convinced they are talking to a secure, verified environment when they are not.
On AMD SEV-SNP, results were narrower the researchers copied the contents of one victim memory page into another but the underlying exposure is the same. Neither platform checks whether memory is fresh.
No Patch, No Timeline
Both Intel and AMD acknowledged DDRop through coordinated disclosure before publication and issued security advisories on September 14. Neither offered a mitigation timeline. Both drew the same line: because the attack requires physical access, it falls outside their published threat model for confidential computing. Intel said it will not assign a CVE.
The researchers are direct about why a software fix cannot solve this. The freshness check was deliberately left out. Scalable memory encryption trades freshness for the ability to protect the large amounts of memory that cloud servers require. A lasting fix would need new memory-encryption hardware capable of providing both integrity and freshness at scale. Intel has discussed a future proposal called cache-line versioning, but has not committed to a timeline and researchers say it is unclear whether it would stop DDRop anyway.
Short-term software measures restricting the memory management interfaces DDRop abuses, checking that critical writes completed, scanning for interposers at boot, can raise the bar without removing the root cause.
The researchers have no evidence DDRop has been used outside a lab. But the significance is what it proves is possible. Confidential computing is the technical promise that certain workloads stay private regardless of who owns the physical hardware. DDRop shows that promise has a physical boundary that can be crossed with $159 in components, a few minutes of access, and knowledge that a rogue data center employee, supply chain tamperer, or government compulsion order could all plausibly provide.
The full paper is scheduled for presentation at ACM CCS 2026 in November. Hardware designs, firmware, and proof-of-concept code are already on GitHub.
