I’m not sure anyone involved in this space seriously believed in the physical attack resistance TDX/SNP. At least not yet. The attack surface is just so vast.

I’m not sure anyone involved in this space seriously believed in the physical attack resistance TDX/SNP. At least not yet. The attack surface is just so vast. This reads like yet another overhyped named vulnerability. These tools are a fence. The fence started out pretty short with AMD’s original SEV and has been getting taller since. Taking the software operators out of the trust boundary is still (comparatively) viable despite this type of attack. And, if the cloud provider sends you attestations proving your workload is in their Real Deal data center with actual guards, cameras, and compliance operations, I’d expect this specific attack to be irrelevant. —————— Only had a quick skim at the paper. Looks like they are mucking with the DDR sticks to make aliasing possible, which lets them circumvent integrity protection. I thought circumventing integrity was already possible-ish with rowhammer and SNP? SNP doesn’t store integrity bits anywhere so it can’t even pretend to catch changes in dram.