DDRop Attack Breaks Intel TDX and AMD SEV‑SNP Confidential Computing

Researchers disclosed a new hardware attack called DDRop reported in September 2026 that breaks the memory protection mechanisms used by Intel’s Trusted Domain Extensions (TDX) and AMD’s Secure Encrypted Virtualization – SEV‑SNP. The technique silently drops writes to server memory so that the processor continues reading old encrypted data as if it were current, effectively bypassing isolation intended for confidential workloads. To launch the attack an adversary must already control the server's software and briefly access the machine to insert a small circuit into its DRAM controller ¹.

The core of this attack exploits a side‑channel vulnerability in DRAM controllers; specifically, writes to memory are not strictly atomic. This allows an attacker with code-execution privileges on the host—common in malware scenarios—to manipulate cached data before encryption or decryption operations complete correctly, thereby circumventing hardware isolation designed for secure enclaves. Initial proposals for these confidentiality features appeared at USENIX Security conferences in 2018, and since then cloud providers have relied on them to protect sensitive user information.

DDRop also demonstrates that similar vulnerabilities exist beyond Intel and AMD. ARM’s Scalable Vector Extension (SVE) has shown related speculative load issues when mitigations aren’t properly integrated during chip design revisions every two years or so mandated through PCI DSS standards. Consequently any environment using these confidential computing technologies could be exposed to unauthorized reads until firmware and OS level fixes are deployed.

Expert analysis notes that DDRop’s silent dropping resembles Spectre/Meltdown, which mislead CPUs into reading past their intended boundaries by exploiting speculative execution. It highlights the importance of updating firmware and operating system patches to handle non-atomic writes. Operators should rethink trust models, using zero-trust so that every access requires fresh authentication, preventing attackers from staying hidden after an initial breach. These steps will help mitigate the risk posed by DDRop and similar side‑channel exploits that threaten the integrity of confidential computing environments.

The attack shows how even advanced hardware isolation can be underm