Researchers have disclosed DDRop, a hardware attack that targets confidential-computing systems from Intel and AMD. By silently preventing selected writes from reaching memory, the attack causes processors to read older encrypted values as though they were current.
The attack requires control of the server’s software and brief physical access to install a small circuit board, known as an interposer, between the processor and a memory module. The researchers estimate that building one costs about $159 in parts.
How DDRop defeats memory freshness
Confidential-computing technologies encrypt server memory so that data remains protected even from a cloud provider with physical access to the machine. To support large memory capacities, however, Intel TDX, Intel Scalable SGX, and AMD SEV-SNP do not provide a freshness guarantee for every value.
That means the processor can verify that data is encrypted and valid, but not necessarily that it is the newest version. DDRop exploits this limitation by forcing an error on the memory command bus and then preventing the memory module from reporting the error. The module discards the write, while the processor is not informed that it failed.
The researchers describe DDRop as the first active interposer attack demonstrated against DDR5 memory in current cloud servers. Earlier work, including TEE.fail, passively monitored the memory bus, while Battering RAM targeted older DDR4 systems.
Demonstrated effects on Intel TDX
On Intel TDX, the researchers used dropped writes to gain control of protected virtual-machine memory-management structures. They reported reading a victim virtual machine’s private memory, switching it into debug mode, and copying its memory in plaintext before restoring the original state.
They also changed a virtual machine’s launch measurement, which is used to show a remote customer that the machine started in a trusted configuration. A virtual machine controlled by the attacker could then pass that check as if it were trusted.
The memory-reading and debug-mode demonstrations were conducted in TDX’s default logical-integrity mode. Intel’s optional cryptographic-integrity mode would block those two results, according to the researchers, because they modify data belonging to another virtual machine. The team argues that attestation forgery may still be possible because the relevant write occurs within the attacker’s own virtual machine. However, their test system did not support cryptographic integrity, so they could not confirm that result.
Scope, response, and remaining uncertainty
On AMD SEV-SNP, the demonstrated impact was narrower: dropped writes during page relocation allowed the researchers to copy one victim page into another. The debug-mode and attestation-forgery techniques were specific to Intel TDX.
Intel’s older Client SGX is not affected because it uses a hardware integrity tree that detects stale data. NVIDIA’s confidential-computing GPUs were not considered reachable because their memory is inside the chip package. The researchers did not test Arm’s CCA and said it may also be affected.
The attack targets cloud servers rather than home computers or phones. The researchers said they had no evidence that DDRop, or a comparable active interposer, had been used outside a laboratory. They also emphasized that the research does not show that AWS, Microsoft Azure, or Google Cloud has been breached.
There is no simple software patch because the researchers identify the root cause as a hardware-design tradeoff. Possible defenses include restricting abused memory-management features, verifying that important writes completed, and checking for an interposer during boot. Intel and AMD were notified before disclosure, but the researchers said neither had provided mitigation guidance or a timeline. No CVE was assigned; Intel considers physical interposer attacks outside its published protection scope and does not plan to assign such attacks a CVE.
Intel’s optional cryptographic-integrity mode already blocks part of the demonstrated activity. Intel is also developing future memory-encryption designs that may add freshness checks, while the researchers said it remains unclear whether the proposed cache-line versioning approach would stop DDRop.
Original source: thehackernews.com
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
