TEE .fail - Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition

The talk starts from the premise that trusted execution environments protect code and data even against a malicious hypervisor or physical access to RAM. The speakers argue that server TEEs, including Intel SGX for data center parts, TDX, and AMD SEV-SNP, moved to a memory encryption engine that gives up integrity and replay protection, and that the remaining confidentiality is deterministic. They describe building a DDR5 bus interposer from e-commerce parts, with a refurbished logic analyzer standing in for a commercial tool priced around $300,000. Early attempts damaged boards and failed to boot, and the team reports that a working interposer took a lot of manual rewiring.

Captures showed that writing the same plaintext to memory produces the same ciphertext, which the speakers used as a dictionary-style oracle. They paused an enclave between iterations of an ECDSA signing loop, observed the 5-bit lookup table reads for each nonce chunk, and recovered the nonce and then the platform attestation key during the live demo. They say the key lets an attacker forge attestation for SGX and TDX, with examples including blockchain confidential computing and NVIDIA confidential compute. The vendors treat the issue as out of scope, and a real fix needs new hardware, while software-only randomized encryption is very costly.

The practical takeaway is that attestation-based trust on server TEEs should not be assumed to hold against an attacker with physical access to the memory bus. Operators who depend on these guarantees should reassess their threat model, and researchers should expect cheap bus-level tooling to be part of the attack surface.