Affected Systems

Intel TDX, Intel Scalable SGX, and AMD SEV-SNP confidential computing technologies used in cloud platforms (AWS, Azure, Google Cloud). Requires DDR5 memory systems. Intel Client SGX and NVIDIA confidential GPUs are not affected. Arm CCA status untested but potentially vulnerable.

Exploitation Status

Proof-of-concept demonstrated in lab environment. Researchers releasing interposer board designs, firmware, and attack code on GitHub. No evidence of exploitation in the wild. Attack requires both software control of target server and brief physical access to install $200 interposer hardware between CPU and memory.

Business Impact

Attackers with physical access can bypass confidential computing protections designed to keep customer data private from cloud providers. On Intel TDX, attackers can read victim VM memory, enable debug mode for plaintext memory access, and forge attestation measurements. On AMD SEV-SNP, attackers can copy victim page contents. No software patch available—vulnerability is in hardware design that trades freshness guarantees for scalability. Cloud providers using these technologies for customer workload isolation face architectural security gap.

Urgency

🟡 Within a week

Recommended Actions

  • Audit physical access controls for data centers hosting Intel TDX, Scalable SGX, or AMD SEV-SNP systems—focus on preventing unauthorized hardware insertion between CPU and memory modules
  • Review cloud provider security attestations and SLAs for confidential computing services (AWS Nitro Enclaves, Azure Confidential Computing, Google Confidential VMs) to understand physical security guarantees
  • Monitor for anomalous memory behavior or unexpected attestation patterns in TDX/SEV-SNP workloads, though detection is difficult as encryption engine shows no errors
  • For high-sensitivity workloads, consider Intel Client SGX (where hardware supports it) or NVIDIA confidential GPUs with in-package memory as alternatives until next-generation hardware addresses freshness guarantees
  • Track vendor advisories from Intel and AMD for potential hardware revisions or mitigations—no CVE assigned yet but research paper and code release at ACM CCS 2026 in November will increase attacker knowledge