Research reveals hardware backdoor in legacy VIA C3 processors

Researcher Christopher Domas has published findings from the Rosenbridge project, revealing a hardware backdoor embedded within certain VIA C3 x86 processors. The vulnerability involves a non-x86 core situated alongside the main processor, which allows userland code to bypass standard privilege checks and access kernel data. While the feature is typically disabled and requires kernel-level access to activate, Domas noted that it is enabled by default on some systems, permitting unprivileged code to modify the kernel.

The embedded core is described as being more deeply integrated than known coprocessors such as the Intel Management Engine or AMD Platform Security Processor. It possesses direct access to the CPU’s memory, register file, and execution pipeline. The backdoor is controlled by a model-specific-register control bit and is toggled via a specific launch instruction, which feeds commands wrapped in a specially formatted x86 instruction to the hidden core. This core executes a custom Deeply Embedded Instruction Set, circumventing all memory protections.

The scope of the vulnerability is limited to the VIA C-series processors, with later generations reportedly unaffected. These processors are primarily marketed towards industrial automation, point-of-sale systems, ATM hardware, and healthcare equipment, alongside consumer desktop and laptop computers. VIA processors are well-regarded for their low power consumption and suitability for embedded designs. Domas suggests the functionality was likely created in good faith for the embedded market and unintentionally left enabled on some early generations, with no malicious intent implied.

The research includes utilities to detect the backdoor and scripts to mitigate the issue during the boot process. However, these tools are in an alpha state and may cause system instability, including crashes or hangs, on systems not containing the backdoor. The provided utility must be run on baremetal hardware rather than in a virtual machine. Domas noted that the tools are designed around a specific processor family and may miss the backdoor if it has been modified from the researched form.

The Rosenbridge project is released as a case study and thought experiment illustrating how backdoors might arise in increasingly complex processors. It serves as a starting point for deeper processor vulnerability research, utilizing tools such as sandsifter for uncovering unknown instructions. The work aims to help researchers and end-users identify such features and understand the implications of deeply embedded components in modern computing hardware.