DDRop Interposer Drops DDR5 Writes to Breach Intel TDX Page Tables and Attestation

The attack places a switched interposer between CPU and DIMM that runs at full DDR5 speed. By asserting an error on the command bus while suppressing the DIMM's error signal, the module discards the write and the processor receives no indication. Earlier passive interposers such as TEE.fail required bus slowdown; prior active attacks such as Battering RAM targeted only DDR4 address formats. DDRop is the first published active technique effective on current server DDR5.

On Intel TDX the researchers dropped firmware writes of empty page-table entries, leaving attacker-controlled data from prior allocation. This granted a malicious VM arbitrary physical-address mapping, read access to other VMs under logical-integrity mode, debug-mode toggling, and overwrite of launch measurements used for remote attestation. Cryptographic-integrity mode would have blocked cross-VM data changes but not measurement forgery.

The work exposes a persistent design trade-off: encrypting terabytes of DRAM without freshness or integrity metadata leaves systems open to low-cost hardware replay. Cloud providers relying on TDX or SEV-SNP for customer isolation now face a concrete supply-chain vector that software patches cannot close.

Board schematics, firmware and exploit code will be released on GitHub alongside the ACM CCS 2026 paper. Vendors must decide whether to mandate cryptographic integrity or accept that any machine with brief physical access can be persistently compromised.