New DDRop Attack Bypasses Intel TDX and AMD SEV-SNP Confidential Computing
A novel hardware attack named DDRop silently drops memory writes, undermining Intel TDX and AMD SEV-SNP confidential computing protections.
Researchers have unveiled a sophisticated new hardware attack, dubbed DDRop, capable of bypassing the confidential computing protections offered by both Intel's Trust Domain Extensions (TDX) and AMD's Secure Nested Paging (SEV-SNP). This attack exploits a fundamental weakness in how processors handle memory writes, allowing an attacker to manipulate data without detection.
The core mechanism of DDRop involves the silent dropping of write operations to a server's memory. In a confidential computing environment, data is encrypted while in memory. When the processor needs to access this data, it decrypts it. DDRop exploits this process by intercepting and discarding legitimate write requests from the system's software. Consequently, the processor continues to operate on stale, encrypted data that it believes is current, leading to incorrect computations and potential data leakage or manipulation.
This attack is particularly concerning because it targets the very integrity of isolated, encrypted memory enclaves designed to protect sensitive workloads. Both Intel TDX and AMD SEV-SNP aim to provide strong isolation for virtual machines or specific applications, even from the hypervisor or host operating system. DDRop demonstrates that hardware-level protections can be circumvented through subtle manipulation of memory access.
Successful execution of the DDRop attack requires a specific set of conditions. Firstly, the attacker must already possess software control over the target server. This prerequisite implies that the initial compromise has already occurred through other means, such as exploiting a software vulnerability or gaining unauthorized access. Secondly, the attacker needs brief, direct physical access to the server.
During this physical access window, the attacker must insert a small, custom-built circuit into the server's memory bus. This circuit is designed to intercept and selectively drop memory write commands originating from the compromised software. The physical access requirement makes DDRop a more challenging attack to execute remotely, but it poses a significant threat in scenarios involving insider threats or physical breaches of data centers.
The implications of DDRop are far-reaching for organizations relying on confidential computing for sensitive data processing, such as financial institutions, healthcare providers, and cloud service providers. The attack could lead to the exposure of secrets, manipulation of critical computations, or the introduction of subtle errors that are difficult to detect and diagnose.
While the attack requires physical access and prior software compromise, its ability to bypass advanced hardware security features highlights the ongoing cat-and-mouse game between security researchers and hardware manufacturers. It underscores the need for continuous vigilance and the development of more robust defense mechanisms against side-channel and hardware-level attacks.
Further research is expected to explore potential hardware and firmware mitigations that could detect or prevent such memory write-dropping attacks. Until then, organizations utilizing confidential computing should remain aware of the potential risks and ensure stringent physical security controls are in place, alongside robust software security practices.
This new reporting from The Register details the DDRop hardware interposer's specific mechanism for interfering with DDR5 write operations, allowing it to deterministically succeed in under two minutes. It also highlights that the attack breaks the integrity of Intel TDX, Scalable SGX, and AMD SEV-SNP, and that Intel and AMD have stated the attack is out of scope for their current threat models, with no immediate patches planned.