SECURITY Signal 505
Hardware backdoors in some x86 CPUs
A researcher discovered a hardware backdoor in some VIA C3 x86 processors that allows userland code to bypass kernel protections and freely read or write kernel data.
Systems running these specific processors, particularly in industrial, point-of-sale, ATM, and healthcare settings, may be vulnerable to privilege escalation if the backdoor is enabled by default. The discovery provides a concrete case study for how deeply embedded, non-x86 cores can subvert processor security boundaries.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The rosenbridge backdoor is a hidden, non-x86 core inside some VIA C3 processors that executes a custom instruction set, bypassing all memory protections and privilege checks.
While the backdoor is supposed to require kernel-level access to activate via a model-specific-register, it has been observed enabled by default on some systems.
Only VIA C3 CPUs are thought to be affected, and later generations no longer contain this feature, but a software fix can only disable it early in boot and cannot prevent a kernel-level attacker from re-enabling it.
THE CLUSTER