DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory

A newly disclosed hardware attack dubbed DDRop can undermine Intel Trust Domain Extensions (TDX) by manipulating DDR5 memory traffic, allowing an attacker with physical server access to force confidential virtual machines into debug mode and extract private memory in plaintext.

Researchers from KU Leuven, ETH Zurich, Google, Durham University, and other institutions released proof-of-concept code, hardware designs, firmware, and attack tooling for DDRop in a public GitHub repository.

The project targets Intel TDX, Intel Scalable SGX, and AMD SEV-SNP three major trusted execution environment technologies designed to protect workloads from an untrusted hypervisor or cloud operator

The low-cost device actively interferes with the DDR5 command/address bus at native operating speed by injecting parity errors.

This enables the attacker to silently discard selected cache-line writebacks, a technique described as “write dropping,” or swap chip-select signals.

When a write is dropped, the processor believes the operation completed, but the old encrypted contents remain in DRAM.

Since the affected confidential-computing architectures do not provide scalable cryptographic freshness guarantees for every protected memory line, the processor can later decrypt and accept stale data as valid current state.

That primitive turns a physical fault into a controlled memory replay condition.

Instead of breaking AES-based memory encryption, DDRop exploits the fact that encrypted memory integrity does not necessarily prove that retrieved content is the latest version of that data.

The most severe DDRop demonstration affects Intel TDX. TDX isolates a Trust Domain’s private memory and critical control structures from the host virtual machine monitor.

Its Secure Extended Page Table, or SEPT, and Trust Domain Control Structure, or TDCS, are intended to be inaccessible to ordinary host software.

DDropattack Researchers said that, the attack demonstrates that memory encryption alone cannot prevent replay-style attacks when a platform lacks cryptographic freshness protection.cdrdv2-public.

Intel TDX Under Attack

The researchers showed that by dropping writes during initialization of sensitive TDX metadata, stale attacker-controlled values can persist where the TDX module expects cleared or updated entries.

DDRop uses a custom DDR5 RDIMM interposer positioned between a server processor and its memory module.Github said.

Malicious Secure EPT entries can then be injected to map memory in ways that violate the expected isolation boundary.

This enables an attacker-controlled trust domain to access a victim TD’s memory and alter protected metadata.

Most notably, the researchers demonstrated flipping the victim’s ATTRIBUTES.DEBUG state, forcing the VM into TDX debug mode.

Under Intel’s architecture, a debuggable TD is inherently untrusted: the host VMM can use TDX module functions to read or modify the TD’s vCPU state and private memory.

Intel also specifies that a TD’s debuggability is reflected in attestation-related data, allowing relying parties to identify debug-enabled workloads if they validate the appropriate attributes.cdrdv2-public.

In the DDRop proof of concept, researchers reportedly copied victim memory in plaintext after enabling debug mode, then restored the original state.

They also demonstrated the potential to manipulate TDX metadata to produce forged attestation reports, creating a risk that a backdoored VM could appear trustworthy to a remote verifier.

DDRop is not a remote exploit. An attacker must gain physical access to a target server and install the custom DDR5 interposer between the processor platform and compatible RDIMM memory.

The published research lists systems using Intel 5th- or 6th-generation Xeon Scalable processors with TDX enabled among the environments needed for end-to-end replication.

That requirement narrows immediate exposure but creates major implications for cloud providers, colocation facilities, managed-hosting operators, and high-assurance on-premises deployments.

Confidential computing customers often rely on TDX or SEV-SNP because they do not assume the infrastructure operator is trusted.

DDRop shows that physical supply-chain access or malicious data-center maintenance access can become a direct threat to that assurance model.

The researchers argue that there is no simple software patch for the underlying issue because the attack exploits a deliberate scalability trade-off: modern cloud TEEs protect large memory capacities without maintaining per-line freshness metadata.

Earlier integrity-protected enclave designs provided stronger freshness guarantees but were constrained by protected-memory scale.

Intel acknowledged the disclosure and said the attack falls outside its cloud-computing threat model, while it evaluates architectural hardening and detection mechanisms.

Organizations using confidential VMs should therefore treat physical server custody, tamper-evident controls, hardware supply-chain assurance, and attestation validation as essential security boundaries not merely operational safeguards.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.