Rosenbridge: a Hardware Backdoor in Some x86 Processors

Security researcher Christopher Domas (also known as @xoreaxeaxeax) has presented rosenbridge — a detailed account of a hardware backdoor built into a range of desktop, mobile and industrial x86 processors.

A hidden core inside the processor

The crux of the finding is that, alongside the main x86 core, the die carries a small additional core running on its own, non-x86 instruction set. Domas calls it a “deeply embedded instruction set.” This core is activated by a bit in a special processor register (an MSR), after which it can be “launched” with a dedicated instruction and fed commands wrapped inside specially crafted x86 instructions.

The danger is that the hidden core executes these commands bypassing all privilege checks and memory protection. Code from user space (ring 3) is able to freely read and modify the operating system kernel's data (ring 0). According to the author, rosenbridge sits deeper than any known coprocessor such as the Intel Management Engine or the AMD Platform Security Processor: it has access not only to all of the processor's memory, but also to its registers and its execution pipeline.

Who is affected

Formally, activating the backdoor requires kernel privileges. However, the researchers found that on some systems it is enabled by default — which means any unprivileged code can seize control of the kernel with no additional prerequisites whatsoever.

The affected chips are VIA C3 processors. This line was aimed at industrial automation, point-of-sale terminals, ATMs and medical equipment, and it also turned up in consumer desktops and laptops. The good news: the scope of the vulnerability is limited — the generations of processors after the C3 no longer have this feature.

No malicious intent

Domas stresses that he does not ascribe malicious intent to the manufacturer. In his view, the mechanism was probably conceived in good faith — as a useful capability for the embedded market — and was left enabled through oversight on the early chip generations. VIA is known for low-power processors that are well suited to embedded solutions.

The repository publishes a set of tools: a utility for checking a processor (which must be run on “bare metal,” not in a virtual machine), a script for closing the backdoor early in the boot process, and also an assembler for the hidden instruction set along with a whole arsenal of fuzzers — the very ones used to uncover the undocumented mechanism. The author presents the work as an educational case study and a thought experiment: a demonstration of how such backdoors can arise in ever more complex processors, and how they can be detected.

Source: Hacker News