Rosenbridge: A hidden RISC core lets userland hijack the kernel on VIA C3 chips

Security researcher Christopher Domas (xoreaxeaxeax) documented a hardware backdoor buried inside certain VIA C3 x86 processors. Alongside the main x86 core sits a small, undocumented non-x86 core that can be woken by setting a model-specific register bit and issuing a launch instruction. Once active, it accepts commands wrapped in specially crafted x86 instructions — a ‘deeply embedded instruction set’ — and executes them with no regard for memory protection or privilege rings. The upshot: ring 3 code can read and write ring 0 kernel memory at will. Activation is supposed to require kernel privileges, but Domas found the feature shipped enabled by default on some systems, meaning any unprivileged process could escalate to full kernel control.

What makes rosenbridge notable is how deep it sits. Unlike the Intel Management Engine or AMD’s Platform Security Processor, this coprocessor isn’t a sidecar with its own domain — it reaches into the main CPU’s memory, register file, and execution pipeline directly. The affected VIA C-series parts were sold into industrial automation, point-of-sale terminals, ATMs, and healthcare equipment as well as consumer desktops and laptops, though later processor generations dropped the feature, so the practical blast radius is narrow.

Domas frames the work as a case study rather than an accusation, arguing the mechanism was likely a legitimate embedded-market feature accidentally left enabled, with no malicious intent implied. The repository ships tooling to detect an affected CPU (baremetal only, and fragile — it may hang machines that lack the exact backdoor variant), a boot-time script to close it via MSR writes, and the fuzzing infrastructure used to reverse-engineer the hidden core. Even the fix is partial: an attacker who already holds kernel access can simply re-enable the backdoor. The broader point is a warning about how such capabilities can hide in increasingly complex silicon and how few tools exist to find them.