🔴 DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory

A newly disclosed hardware attack dubbed DDRop can undermine Intel Trust Domain Extensions (TDX) by manipulating DDR5 memory traffic, allowing an attacker with physical server access to force confidential virtual machines into debug mode and extract private memory in plaintext.

Researchers from KU Leuven, ETH Zurich, Google, Durham University, and other institutions released proof-of-concept code, hardware designs, firmware, and attack tooling for DDRop in a public GitHub repository.

The project targets Intel TDX, Intel Scalable SGX, and AMD SEV-SNP three major trusted execution environment technologies designed to protect workloads from an untrusted hypervisor or cloud operator.