TEE.Fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition

Trusted execution environments (TEEs) aim to offer strong privacy and integrity guarantees even in the presence of root level attackers capable of arbitrarily modifying the system's software. Recently however, there has been a pivotal shift in TEE deployment, moving TEEs from enclaves running on PC-oriented hardware to confidential virtual machines executing on server-grade CPUs. Under the hood, this change has also resulted in significant modifications to the underlying memory encryption engine, removing integrity guarantees and protections against replay attacks. While Intel's and AMD's change in TEE implementation is clearly significant and substantial, most TEE deployments appear to fail to acknowledge the difference in security guarantees, assuming a stronger security model than truly afforded by the implementation. Thus, in this work we investigate the true protection offered by Intel's and AMD's newest TEE offerings against entry-level physical side-channel attacks. We show that, contrary to popular belief, bus interposition attacks on DDR5 server memory can be constructed cheaply by hobbyists, using parts easily obtained on e-commerce websites. Next, combining our ability to monitor DDR5 bus transactions with deterministic memory encryption used by Intel's SGX and TDX as well as AMD's SEV-SNP, we are able to extract secret key material (such as attestation keys in some cases) from machines in fully trusted status. Finally, we demonstrate the implications of our attacks on multiple real world TEE deployments.