Researchers Expose Flaw in Modern Encryption Hardware

"It corrupts commands on the high-speed DDR5 memory bus to silently drop writes to encrypted memory. The protected VM keeps computing on old data that still decrypts perfectly." — Jo Van Bulck, DistriNet lab, KU Leuven

What DDRop does to DDR5 and confidential VMs

Researchers from KU Leuven, ETH Zurich, Durham University, and Google describe a hardware-level replay attack that abuses a fundamental design tradeoff in modern scalable memory encryption. By dropping DDR5 write commands on the memory bus, the attack makes protected virtual machines (VMs) operate on stale, attacker-selected ciphertext that nevertheless decrypts correctly. The team calls the attack DDRop and frames it as an active memory interposer attack on "confidential VMs" protected by hardware TEEs such as Intel TDX, Scalable SGX, and AMD SEV‑SNP.

The underlying weakness is that scalable memory-encryption designs do not enforce cryptographic freshness for protected memory. That omission means a device that can prevent new ciphertext from being written can replay older ciphertext into a VM's address space without tripping cryptographic integrity checks — effectively breaking the integrity guarantees of the protected environment.

Proof-of-concept on Intel TDX: forcible debug mode and forged attestations

The researchers developed a working proof-of-concept against a current Intel TDX server. According to Jo Van Bulck, by "injecting maliciously crafted secure page-table entries, we can force any protected VM into debug mode and read out its private memory in plaintext." He added that "writing to critical TDX metadata structures enables forged attestation reports, so that a backdoored VM appears trusted to the remote user." Both attacks, Van Bulck said, "succeed deterministically in under two minutes without crashing the machine."

Those results tie the technical failure mode — dropped DDR5 writes and replayed ciphertext — directly to practical, high-impact outcomes: extraction of plaintext memory and the ability to present a compromised VM as legitimate via a forged attestation report.

The interposer: design, cost and open-source release

DDRop is implemented with a custom-built interposer, the researchers say, "a small, custom-designed circuit board, costing under $200, that sits between the processor and a memory module." Wired into an appropriate circuit board, the interposer corrupts commands on the DDR5 bus to drop writes at full speed. The team is releasing the complete interposer design as open-source hardware.

The paper contrasts DDRop with previous approaches: older interposition work required high-end lab equipment that the researchers estimate cost about $170,000 to perform, while earlier DDR5 experiments were passive and comparatively crude. Van Bulck noted earlier attacks such as Battering RAM relied on address-aliasing tricks thwarted by DDR5’s redesigned command bus, and passive work like TEE.fail monitored the data bus with bulky, second-hand logic analyzers that "require slowing the memory bus to its lowest speed to observe ciphertext patterns."

Why existing mitigations and vendor models may not stop DDRop

The research team argues there is no simple patch to Intel's and AMD's current scalable memory-encryption designs because the vulnerability stems from deliberate design tradeoffs. "Scalable memory encryption deliberately trades cryptographic freshness ... for the ability to protect large amounts of memory in cloud systems," Van Bulck wrote.

He also said planned mitigations such as "cache line versioning" still appear vulnerable to DDRop. On the vendor side, Intel and AMD characterized the disclosure as outside current threat models: Intel acknowledged the disclosure in a security bulletin, said the attack is out of scope for its cloud computing threat model, and is "evaluating additional architectural hardening options and detection mechanisms as part of ongoing platform security improvements…". AMD likewise said the attack is out of scope and that no mitigation is planned.

What this means for cloud tenants, hardware designers, and data center operators

• Cloud tenants who rely on confidential-computing guarantees should note the researchers’ caveat: DDRop requires physical access to the system, and the attack is chiefly relevant where cloud providers promise isolation and confidentiality to renters.
• Hardware architects and TEE designers must reconcile the scalability-versus-freshness tradeoff the researchers name; Van Bulck and colleagues assert there is "no easy fix" and no simple software or hardware patch that addresses the root cause in current designs.
• Data center operators and administrators may need to reassess physical security assumptions and detection mechanisms given the researchers’ claim that the interposer operates at full DDR5 speed and is inexpensive and compact compared with past lab setups.

The researchers have published a paper, "DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes," and released the interposer design as open-source hardware. Their work replaces heavy, slow, or passive DDR5 experiments with an inexpensive, active technique that, by their account, deterministically breaks integrity guarantees in minutes. With vendors labeling the attack out of scope and researchers warning that planned mitigations may still be vulnerable, the disclosure sharpens a narrow tension: protecting large amounts of cloud memory at scale may, in current designs, leave a technical avenue for a physically able attacker to replay and read supposedly private memory.

Source: The Register — New hardware device can RAM into encrypted memory, expose your data