Rosenbridge reveals hardware backdoor in VIA C3 x86 CPUs
Security researcher Christopher Domas published rosenbridge, a project documenting a hardware backdoor embedded in some VIA C3 x86 processors. The backdoor lets ring 3 (userland) code bypass the CPU's normal protections and directly read and write ring 0 (kernel) data, the level normally reserved for the operating system kernel itself.
The backdoor is a small, non-x86 core embedded alongside the main x86 core on the chip. It is switched on by a model-specific-register control bit and then activated with a launch instruction; once active it accepts commands wrapped inside a specially formatted x86 instruction, which the project calls the 'deeply embedded instruction set.' Those commands bypass all memory protections and privilege checks. The researchers describe rosenbridge as distinct from other known x86 coprocessors, such as the Management Engine or the Platform Security Processor: unlike those, it has direct access to the CPU's register file and execution pipeline, not just its memory.
Normally the backdoor requires kernel-level access to enable. The researchers state they have found it enabled by default on some systems, meaning unprivileged code on those machines can modify the kernel without first escalating privileges. They believe only VIA C3 CPUs are affected; later CPU generations no longer contain the feature, so the scope is limited to that one processor line. VIA C3 chips were marketed for industrial automation, point-of-sale terminals, ATMs and healthcare hardware, as well as some consumer desktops and laptops.
The rosenbridge repository ships utilities to check whether a given processor is affected and, if so, to close the backdoor early in the boot process. The authors note the fix is not permanent: an attacker who already has kernel-level access can still re-enable the backdoor. The check tool is described as alpha-state software meant to run on bare metal rather than inside a virtual machine, and it may crash or hang systems that do not actually contain the backdoor. The authors frame the release as a case study and thought experiment on how such backdoors can arise in increasingly complex processors, and say they believe the feature was built in good faith for the embedded market and left enabled unintentionally on some early units, with no malicious intent implied.
Key facts
- Researcher Christopher Domas published rosenbridge, documenting a hardware backdoor in some VIA C3 x86 CPUs.
- The backdoor lets ring 3 (userland) code bypass processor protections to freely read and write ring 0 (kernel) data.
- It normally needs kernel-level access to enable, but the researchers found it enabled by default on some systems.
- The backdoor is a separate, non-x86 core on the chip with direct access to the register file and execution pipeline, unlike known coprocessors such as the Management Engine.
- The repository ships tools to detect and close the backdoor, though an attacker with existing kernel access can still re-enable it after the fix.
Why it matters
Rosenbridge documents a previously undocumented backdoor built directly into the hardware of some VIA C3 processors, one level below the operating system and beneath any software-level protection. Because it lives in a separate embedded core with its own access to the CPU's register file and execution pipeline, rather than in firmware or a known management coprocessor, it sits outside where security tooling usually looks, and on affected systems it can already be switched on without anyone having enabled it on purpose.
Who it affects
The finding concerns VIA C3 processors specifically; the researchers say later CPU generations no longer carry the feature, so the scope does not extend to newer x86 chips. VIA C3 hardware was sold into industrial automation, point-of-sale terminals, ATMs and healthcare equipment, as well as some consumer desktops and laptops, so owners and operators of that generation of embedded and consumer hardware are the ones with a reason to check their machines.
How to use it
The rosenbridge GitHub repository provides a checker utility (cloned from the repo, built with make, run via 'sudo ./bin/check' after loading the msr kernel module) to test whether a given processor is affected, plus a fix script that can be installed to close the backdoor early in the boot process. The check must run on bare metal, not inside a virtual machine, and the authors warn it is alpha-state software that may crash or hang systems that turn out not to contain the backdoor.
How solid is it
The material comes directly from the project's own repository and its authors, who frame their findings explicitly as their own inferences and opinions rather than an independently confirmed advisory. The source gives no date for when the backdoor was found or the repository published, cites no CVE number or vendor security advisory, does not name which specific VIA C3 models or how many systems ship with it enabled by default, and does not say whether VIA has acknowledged or responded to the finding. Links to a promised whitepaper and slides are marked as not yet available in the repository.
Risks and caveats
The provided fix only addresses the boot-time state: the authors state plainly that an attacker who already has kernel-level access can re-enable the backdoor regardless. The detection tool is explicitly alpha-state and may crash or hang systems it was not designed for. The authors also state they believe the functionality was created in good faith as a feature for the embedded market and left enabled unintentionally on some early processor generations, with no malicious intent implied, a characterization that is their own assessment rather than a confirmed account from VIA.
“The backdoor allows ring 3 (userland) code to circumvent processor protections to freely read and write ring 0 (kernel) data.”
— rosenbridge project (Christopher Domas)