Researchers from KU Leuven, ETH Zurich, Durham University and Google disclosed DDRop on 14 September 2026, after sharing their findings with Intel and AMD. DDRop is a small hardware interposer on a server's DDR5 memory bus. It silently discards selected memory writes. As a result, a confidential virtual machine (VM), whose memory the hardware encrypts, later reads old data that still decrypts correctly. Their paper is listed for the 2026 ACM Conference on Computer and Communications Security.[1]
The researchers say the memory encryption in Intel Trust Domain Extensions (TDX), Intel's Scalable Software Guard Extensions (SGX) and AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) keeps data confidential but does not provide freshness. Without freshness, they say, the processor cannot tell whether a value in memory is current. In TDX's default integrity mode, they report forcing a victim VM into debug mode so the hypervisor, the software that manages virtual machines, can read its memory. They also report overwriting the launch measurement of a rogue VM under their control, even in TDX's stronger cryptographic integrity mode. The launch measurement, which remote attestation reports, is a hash of the software the VM started with. They say the rogue VM then passes remote attestation as a legitimate workload. The parts for one interposer cost $159 at a build quantity of ten, according to the team's bill of materials, which excludes labor.[1]
The attack assumes an adversary who controls the host operating system, hypervisor and BIOS. The adversary also needs a brief, one-time physical visit to install the device. After that, the attack runs in software. The team lists data-center insiders, supply-chain tampering and compelled access as possible routes to the hardware.[1]
Intel's announcement says the scenarios fall outside its standard threat model, the attacks its confidential computing technology is designed to resist. Intel recommends limiting physical access and protecting the supply chain, and says it is evaluating further hardening and detection options.[2] AMD's bulletin says the technique falls outside the published SEV-SNP threat model. It says AMD does not plan to assign a Common Vulnerabilities and Exposures (CVE) identifier or release mitigations.[3] The researchers say software or firmware updates can make the attack harder, but a lasting fix would require memory encryption with integrity and freshness.[1]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
7340f5d581ecfb7d2d0a23ba1ac213130bc49e414442d09498d711edcef8583d
