DDRop: a $159 DDR5 hardware interposer silently drops targeted memory writes, defeating Intel TDX/SGX and AMD SEV-SNP integrity guarantees, no CVE, no vendor fix
Researchers show a cheap hardware add-on can forge Intel TDX attestation reports by tampering with memory writes at the DRAM bus
Analysis
Researchers from KU Leuven, ETH Zurich, Durham University and Google disclosed DDRop, an open-source DDR5 hardware interposer that costs roughly $159 in parts and installs in minutes (DDRop research team, 2026-09-14). Unlike earlier passive bus-snooping attacks (Membuster, WireTap, TEE.fail), DDRop actively abuses the DDR5 bus's error-handling path: it forges a parity error on a targeted write and suppresses the resulting alert, so the memory module silently discards the command while the processor believes the write completed, leaving stale, attacker-chosen ciphertext in place. Unlike earlier passive interposers, which had to slow the memory bus to work with second-hand lab equipment (making the tampering easier to notice) DDRop runs at native DDR5 speed (DDRop research team, 2026-09-14). Against Intel TDX, the team used this to corrupt the TDX module's initialization writes to Secure Extended Page Tables, letting an attacker-controlled Trust Domain remap its own memory onto any physical RAM address; under TDX's default Logical Integrity mode this also lets an attacker corrupt a target Trust Domain's own debug-mode-attribute bit, giving roughly a 50% chance per attempt of forcing the hypervisor's debug API to dump that victim's plaintext memory before the original ciphertext is restored. Even under TDX's stronger Cryptographic Integrity mode, an attacker can still forge their own Trust Domain's launch-measurement attestation, so a backdoored VM passes remote attestation as trusted (DDRop research team, 2026-09-14).
The only prerequisite is brief physical access to install the interposer, on top of the standard confidential-computing threat model of a compromised hypervisor or BIOS; the researchers list malicious data-center technicians, hardware supply-chain tampering and law-enforcement or state seizure as realistic access vectors. Intel and AMD confirmed the findings under coordinated disclosure but both declared physical DRAM-bus attacks out of scope for their current products' threat model, and neither is assigning a CVE or shipping a mitigation (Intel PSIRT, 2026-09-14; AMD Product Security, 2026-09-15). Intel says it is evaluating "Platform Owner Endorsements", a mechanism to let remote parties verify who physically holds sensitive hardware (Intel PSIRT, 2026-09-14), and, per heise's reporting, next-generation memory-encryption schemes with stronger hardware protection (heise Security, 2026-09-16). Research code, hardware schematics and firmware are published publicly; no in-the-wild exploitation is claimed or plausible given the physical-access requirement.
Cited evidence
DDRop is a small, low-cost hardware interposer device that can make writes to a server's memory disappear, causing the computer to read old data as if it were newly written.
This primitive is 100% deterministic and lets an attacker-controlled TD remap its own memory onto any physical address in RAM.
Intel's analysis confirms that the described scenarios fall outside Intel's standard threat model for confidential computing deployments.
AMD has assessed this report and has determined that the described technique relies on a physical attack against the memory bus, which falls outside the scope of the published threat model for SEV-SNP. AMD does not plan to assign a CVE or release mitigations in response to this report.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.