Confidential cloud computing systems are designed to shield user data from server operators. However, a new method known as DDRop reveals potential failures in this promise by exploiting vulnerabilities in the DDR5 memory path.
Understanding the DDRop Attack
This innovative attack is a hardware manipulation technique rather than malware, and it poses a significant threat to tasks safeguarded by Intel TDX and AMD SEV-SNP. It targets the physical components of memory communication, rather than software applications.
Previous research has already questioned the security boundaries within confidential virtual machines. Earlier findings on TDX isolation demonstrated how a malicious virtual-machine manager could monitor activities within a secure domain. DDRop extends these concerns to the hardware level, focusing on memory command transit between processors and server memory.
Technical Insights into DDRop
The researchers behind DDRop, who shared their findings with Cyber Security News, detailed how the attack operates using a custom DDR5 registered DIMM interposer. This device disrupts memory writes at standard operating speeds, utilizing hardware designs, controller firmware, host tools, and proof-of-concept codes.
For the attack to succeed, it requires privileged access to the target machine and brief physical interaction to set up the device. While this limits its impact on typical endpoint users, it raises severe concerns for cloud infrastructure and environments where physical access to servers is possible during maintenance or supply-chain processes.
Impact on Intel and AMD Security
The DDRop interposer, constructed at a modest cost of $159, intervenes between the CPU and DDR5 RDIMM, manipulating command signals without intercepting normal application data. It can induce parity errors, prompting the memory module to dismiss certain write commands without alerting the system.
This results in protected virtual machines potentially reading outdated data, as discarded writes are not replaced with the latest information. The attack affects Intel TDX, Intel Scalable SGX, and AMD SEV-SNP due to incomplete verification of encrypted memory cache lines.
Researchers highlight that while encryption prevents an attacker from reading memory values, it does not guarantee that the data is current. Comparable risks have been noted in DRAM scrambling analyses, emphasizing vulnerabilities in memory address stability assumptions.
Mitigation Strategies and Future Outlook
DDRop’s danger amplifies when malicious hosts exploit trusted memory-management interfaces, enabling interference with page relocation and causing destination pages to hold stale data. This vulnerability allows for deterministic plaintext copying within the same confidential virtual machine’s pages.
The researchers demonstrated that attackers could gain control over address translations, leading to potential ciphertext access, replay attacks, and corruption of critical control structures. They suggest that robust hardware designs implementing cryptographic integrity and freshness checks are essential long-term solutions.
In the interim, organizations should restrict physical server access, monitor firmware and memory configuration changes, cautiously use attestation, and disable unnecessary memory-management features. Additionally, strengthening AI data center practices, including firmware baselines and hardware inventory controls, can mitigate exposure to physical platform attacks.
