A team of IT security researchers has demonstrated how a cheaply manufactured adapter plug can circumvent Confidential Computing protections in modern processors, potentially exposing sensitive virtual machines to memory access attacks. The technique, dubbed DDROP, exploits a gap between how processors encrypt memory and how physical write operations are handled at the hardware level.
The Attack Mechanism
The attack works by inserting a small intermediate device between a DDR5 memory module and its motherboard slot. The plug, built around a Teensy microcontroller connected via ribbon cable, monitors the memory bus but selectively suppresses write commands. When a processor attempts to update memory contents, the adapter generates parity errors or other fault signals that trick the memory module into discarding the write operation—while simultaneously hiding this from the processor, which believes the data was stored successfully.
This creates a window for manipulation. The processor’s memory encryption continuously re-encrypts data on read operations, masking stale values. However, if write operations are silently dropped, old encrypted data remains in the memory cells. When the processor reads those addresses again, it decrypts the outdated contents as if they were current. The system has no mechanism to detect that the last update never actually reached persistent memory.
TDX and Confidential VM Isolation
The researchers tested DDROP against Intel TDX (Trust Domain Extensions), which isolates confidential virtual machines from a potentially compromised hypervisor. Under normal operation, when TDX allocates new secure page tables, it fills them with empty entries using encrypted writes. By suppressing these initialization writes, DDROP allows pre-existing encrypted page table structures to persist. Attackers can engineer these stale entries to point to arbitrary physical memory addresses, effectively giving a malicious trusted domain read and write access to any location in the victim’s memory.
In TDX’s standard Logical Integrity mode, this enables reading and modifying the encrypted page tables and control structures of other trusted domains. The stronger Cryptographic Integrity mode prevents cross-domain manipulation, but DDROP can still bypass attestation measurements and force trusted domains into debug mode. Once in debug mode, the processor exposes plaintext memory contents directly—giving attackers full access to victim virtual machine data.
Affected Platforms and Vendor Response
The researchers identified memory encryption mechanisms from Intel (TDX and Scalable SGX), AMD (SEV-SNP), and possibly Arm as potentially vulnerable. DDROP runs at full memory bus speed without requiring artificial throttling, making it difficult to detect through performance anomalies.
The implications extend beyond academic concern. Confidential Computing promises that organizations can process sensitive data in untrusted environments—even when the data center operator itself cannot be trusted. The researchers outline scenarios including malicious insiders, supply chain compromises, or hardware access by authorities as practical attack vectors.
Intel, AMD, and Arm were briefed on the findings before public disclosure. All three manufacturers confirmed the attack’s feasibility but characterized physical memory bus attacks as outside their current threat models. Intel noted it is exploring next-generation memory encryption technologies with stronger hardware protections. Both Intel and AMD have published security advisories addressing DDROP.
The technique builds on earlier memory manipulation research including BatteringRAM and BadRAM attacks, as well as the purely software-based “Download more RAM” proof-of-concept.