Battering RAM Exploit Bypasses Modern Protections in Intel, AMD Cloud Processors

Cloud providers rely on hardware-based memory encryption to keep user data safe, shielding sensitive information from hackers and insiders. A new attack called Battering RAM shows these safeguards can be defeated with a tiny hardware add-on costing less than $50.

Researchers have developed a low-cost interposer, a small board that fits between the processor and memory module, which remains transparent during boot but can be activated after startup to redirect encrypted memory requests to attacker-controlled locations. The attack rewrites address metadata and enables a replay of ciphertext, allowing plaintext exposure within protected enclaves or virtual machines and giving full read or write access to memory regions guarded by Intel SGX or AMD SEV-SNP.

Intel SGX and AMD SEV-SNP protections can be bypassed without detection by software, as the exploit operates below the operating system and hypervisor. Defences proposed include cryptographic integrity checks on memory metadata, runtime verification of memory mapping, and tamper-evident hardware; broader memory encryption redesigns are anticipated.