DDRop hardware attack bypasses DDR5 memory encryption in cloud TEEs

Researchers from KU Leuven, ETH Zurich, Durham University, and Google have developed a hardware device capable of bypassing memory encryption in confidential computing environments. The attack, dubbed "DDRop," allows an adversary with physical server access to compromise the privacy of protected virtual machines (VMs).

The DDRop device is a custom circuit board costing under $200 that functions as an active interposer, sitting between the processor and DDR5 memory modules. According to Jo Van Bulck, a professor in the DistriNet lab at KU Leuven, the device corrupts commands on the high-speed DDR5 memory bus to silently drop write operations to encrypted memory. This forces the protected VM to continue computing using stale data that still decrypts perfectly. By injecting maliciously crafted secure page-table entries, the researchers demonstrated they could force any protected VM into debug mode, allowing them to read private memory in plaintext or forge attestation reports. The attack succeeds deterministically in under two minutes without crashing the system.

The shift to DDR5

Confidential computing relies on memory encryption to ensure that data remains private, even from the cloud provider hosting the infrastructure. This is primarily achieved through Trusted Execution Environments (TEEs), including Intel TDX, Scalable SGX, and AMD SEV-SNP. While similar attacks existed for DDR4, the redesigned command bus of DDR5 was widely believed to prevent the address-aliasing techniques used in previous exploits. DDRop represents the first active interposer attack on DDR5 that operates at full bus speed. This breakthrough significantly lowers the barrier to entry for such attacks, reducing the required equipment cost from an estimated $170,000 in laboratory gear to a simple $200 board.

Implications for cloud security

This vulnerability undermines the core security guarantees of TEEs, which are designed to assure tenants that their data is shielded from the infrastructure owner. Because the flaw is architectural—essentially trading cryptographic freshness for system scalability—there is no simple software patch available. This leaves high-value targets in colocation or cloud environments potentially exposed to anyone who can gain physical access to the hardware.

Vendor response

Both Intel and AMD have addressed the findings, stating that the attack is "out of scope" for their current cloud computing threat models. Consequently, neither company has immediate patches planned to mitigate the vulnerability. While some planned mitigations such as "cache line versioning" have been proposed, researchers suggest these may still be vulnerable to the DDRop method.