A research project called Rosenbridge has revealed a hardware backdoor embedded in certain x86 processors, specifically VIA C3 CPUs, which allows ring 3 (userland) code to circumvent processor protections and freely read and write ring 0 (kernel) data. According to the source, the backdoor consists of a small, non-x86 core alongside the main processor core and is activated via a model-specific-register control bit and a launch-instruction. Once enabled, the hidden core executes commands from a custom instruction set, bypassing all memory protections and privilege checks. While the backdoor typically requires kernel-level access to activate, it has been observed to be enabled by default on some systems, allowing any unprivileged code to modify the kernel. The Rosenbridge backdoor is distinct from other known x86 coprocessors like the Management Engine or Platform Security Processor, as it has deeper access to the CPU’s memory, register file, and execution pipeline. The vulnerability is limited to certain generations of VIA C3 processors used in industrial automation, point-of-sale systems, ATMs, healthcare hardware, and some consumer desktops and laptops; newer CPU generations do not contain this feature. The researchers note that the functionality may have been intended as a useful embedded feature but was unintentionally left enabled on early processor generations. Tools are provided to check for the backdoor, and a script exists to disable it during boot, though it requires adaptation for different systems and does not prevent re-enablement by an attacker with kernel access. The research is presented as a case study on how backdoors might arise in complex processors and how they can be detected.
Key facts
- The Rosenbridge backdoor allows userland code to read and write kernel memory by bypassing CPU protections.
- The backdoor is a non-x86 core embedded alongside the main x86 core in VIA C3 processors.
- It is activated via a model-specific-register bit and a launch-instruction, then fed commands through a specially formatted x86 instruction.
- While typically requiring ring 0 access to enable, the backdoor is enabled by default on some systems.
- The backdoor provides access to memory, register file, and execution pipeline, exceeding the access of known coprocessors like the Management Engine.
- Only VIA C3 CPUs are thought to be affected; later generations do not contain this feature.
- Utilities are provided to detect, analyze, and partially mitigate the backdoor, but require baremetal execution and may be incomplete if the backdoor has been modified.