A devastating new attack technique has been discovered, compromising the confidentiality of sensitive data stored on Intel and AMD systems. The DDRop (Direct Data Remote Operation) attack exploits vulnerabilities in Trusted Domain Extensions (TDX) for Intel and Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) for AMD, breaking through the security features designed to protect confidential computing environments.
The affected systems are widely used by organizations across various industries, including finance, healthcare, and government. Confidential computing is a critical component of modern cloud infrastructure, enabling secure processing of sensitive data without exposing it to untrusted environments. The DDRop attack jeopardizes this promise of confidentiality, allowing unauthorized access to data that was previously thought to be protected.
DDRop attacks work by exploiting vulnerabilities in the Trusted Execution Environment (TEE) and Secure Encrypted Virtualization (SEV) features. These security mechanisms are designed to isolate sensitive computations from the rest of the system, using hardware-based encryption and secure boot processes. However, the DDRop attack takes advantage of weaknesses in these implementations, allowing an attacker to bypass TEE and SEV protections.
The severity of this vulnerability is compounded by its potential for lateral movement within a compromised environment. Once an attacker gains access to sensitive data through DDRop, they can use it as a stepping stone to exploit other vulnerabilities, ultimately leading to a complete breach of the system’s confidentiality. This highlights the importance of robust security measures in protecting against attacks like DDRop.
The discovery of DDRop underscores the ongoing cat-and-mouse game between attackers and defenders in the world of cybersecurity. As organizations continue to rely on cloud-based infrastructure for sensitive processing, they must remain vigilant against emerging threats like this one. To mitigate the risk of DDRop attacks, it is essential that system administrators implement robust security protocols, monitor their systems closely for signs of compromise, and stay informed about the latest developments in attack techniques.
In light of this vulnerability, we recommend that organizations immediately review their confidential computing environments to ensure they are properly configured to resist DDRop attacks. This includes implementing additional security controls, such as secure boot mechanisms and regular software updates, to prevent attackers from exploiting vulnerabilities in TEE and SEV implementations. By taking proactive steps to address the threat of DDRop, organizations can minimize their risk of data breaches and protect sensitive information.
Source: The Hacker News — 2026-09-14