● Covered by 1 source · 1 reportLow impact1 negative
Hardware Backdoor Discovered in Some x86 CPUs, Allowing Kernel-Level Access
Key points
- "rosenbridge" backdoor found in some x86 CPUs, primarily VIA C3 series.
- Allows userland code to read/write kernel data, bypassing protections.
- Backdoor is a deeply embedded, non-x86 core within the CPU.
- Found enabled by default on some systems, despite requiring kernel access to activate.
Discovery of the "rosenbridge" Backdoor
A hardware backdoor, named "rosenbridge," has been identified in specific x86 processors used in desktops, laptops, and embedded systems. This backdoor enables ring 3 (userland) code to circumvent processor protections, gaining the ability to read and write ring 0 (kernel) data without authorization.
Technical Details of the Backdoor
The "rosenbridge" backdoor consists of a small, non-x86 core embedded within the main x86 core of the CPU. It is activated via a model-specific-register control bit and a launch instruction. Once active, this embedded core executes commands, referred to as the 'deeply embedded instruction set,' which bypass all memory protections and privilege checks. While typically requiring kernel-level access to enable, the backdoor has been observed to be enabled by default on some systems, allowing unprivileged code to modify the kernel.
Distinction from Other Coprocessors
This backdoor is distinct from other known x86 coprocessors like the Management Engine or Platform Security Processor. It is more deeply embedded, possessing access not only to the CPU's memory but also its register file and execution pipeline.
Affected Processors and Scope
The vulnerability is primarily thought to affect only VIA C3 CPUs. These processors are commonly found in industrial automation, point-of-sale systems, ATMs, healthcare hardware, and various consumer desktop and laptop computers. The scope of this vulnerability is limited, as CPU generations after the C3 series no longer include this feature.
Research and Mitigation Tools
Researchers have released utilities to check if a processor is affected and to close the backdoor if present. This work is presented as a case study to illustrate how hardware backdoors can emerge in complex processors and how they might be identified by researchers and end-users. The provided tools and research aim to facilitate further processor vulnerability research.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub cmc_internal/api GitHub github/collect GitHub xoreaxeaxeax/rosenbridge GitHub _private/browser GitHub get-started/accessibility GitHub open-source/sponsorsReporting from
Researchers have uncovered a hardware backdoor, dubbed "rosenbridge," in certain desktop, laptop, and embedded x86 processors, specifically VIA C3 CPUs. This backdoor allows userland code to bypass processor protections and freely read and write kernel data, and has been found enabled by default on some systems.