The machines cloud providers rent as confidential are supposed to keep tenant memory beyond the operator’s reach. Work from KU Leuven, ETH Zurich, Durham University and Google shows that protection can be undone with a small board costing less than $200.
The team built an interposer called DDRop that sits between a processor and a DDR5 module. Instead of reading the bus, it interferes with it at full speed, discarding writes bound for encrypted memory so the contents stay stale. A protected virtual machine has no way to notice, and keeps working from data an attacker chose earlier.
Intel TDX, Scalable SGX and AMD SEV-SNP all lose their integrity guarantees to the trick. Testing on a live TDX server, the researchers pushed forged secure page-table entries into a protected VM, flipped it into debug mode and pulled plaintext memory out. Tampering with TDX metadata let them mint fake attestation reports, making a backdoored VM look trustworthy to whoever connects.
Both variants worked without crashing the host, finishing in under two minutes. The design is being published as open-source hardware, and the authors call it the first active DDR5 interposer attack, plus a far cheaper one than predecessors that leaned on roughly $170,000 of lab gear.
Nobody has a clean remedy. Scalable memory encryption was built to cover large cloud workloads by giving up the freshness checks early Intel SGX offered at small scale, and Intel classed the finding as outside its cloud threat model while promising more hardening work.
