// the find
xoreaxeaxeax/rosenbridge
Hardware backdoors in some x86 CPUs
Research tools from Christopher Domas documenting a hidden instruction set core embedded in VIA C3 x86 CPUs that bypasses all memory protection and privilege checks. The backdoor lets ring 3 userland code read and write kernel memory. Scope is narrow — only affects VIA C3 era chips, mostly found in industrial, ATM, and point-of-sale hardware.
The privilege escalation proof-of-concept in esc/ is concrete and runnable, not just a theoretical writeup. The fuzzing infrastructure is methodologically interesting — a stripped-down sandsifter variant plus a distributed manager with power cycling, which is what you actually need when a fuzz target can hang or kernel-panic the machine. The assembler for the Deeply Embedded Instruction Set turns the hidden core into something programmable rather than just a one-trick escalation gadget. Domas is careful to separate what was observed from what was inferred, which is rare in vulnerability disclosure.
The detection utility (util/check.c) is self-described as alpha and warns it may crash systems without the backdoor — not something you'd run on a machine you care about. The whitepaper and slides are TODOs in the README; the research was presented at DEF CON 2018 but the docs were never linked here, so the repo is incomplete as a standalone reference. The fix is only a soft mitigation: it closes the MSR bit at boot but any attacker already at ring 0 can reopen it immediately. Last commit is 2018 — no updates, no follow-on work for later VIA generations.