: hardware backdoors in x86 CPUs
github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax
project:rosenbridge reveals a hardware backdoor in some desktop, laptop, and
embedded x86 processors.
The backdoor allows ring 3 (userland) code to circumvent processor protections
to freely read and write ring 0 (kernel) data. While the backdoor is typically
disabled (requiring ring 0 execution to enable it), we have found that it isenabled by defaulton some systems.
This repository contains utilities to check if your processor is affected, close
the backdoor if it is present, and the research and tools used to discover and
analyze the backdoor.
The rosenbridge backdoor is a small, non-x86 core embedded alongside the main
x86 core in the CPU. It is enabled by a model-specific-register control bit,
and then toggled with alaunch-instruction. The embedded core is then fed
commands, wrapped in a specially formatted x86 instruction. The core executes
these commands (which we call the ‘deeply embedded instruction set’), bypassing
all memory protections and privilege checks.
While the backdoor should require kernel level access to activate, it has been
observed to beenabled by defaulton some systems, allowing any unprivileged
code to modify the kernel.
The rosenbridge backdoor is entirely distinct from other publicly known
coprocessors on x86 CPUs, such as the Management Engine or Platform Security
Processor; it is more deeply embedded than any known coprocessor, having access
to not only all of the CPU’s memory, but its register file and execution
pipeline as well.
It is thought that only VIA C3 CPUs are affected by this issue. The C-series
processors are marketed towards industrial automation, point-of-sale, ATM, and
healthcare hardware, as well as a variety of consumer desktop and laptop
computers.
The scope of this vulnerability is limited; generations of CPUs after the C3 no
longer contain this feature.
This work is released as a case study and thought experiment, illustrating how
backdoors might arise in increasingly complex processors, and how researchers
and end-users might identify such features. The tools and research offered
here provide the starting point for ever-deeper processor vulnerability
research.
To check if your CPU is affected:
The provided utility must be run on baremetal (not in a virtual-machine), and is
in analphastate. It may crash, panic, or hang systems not containing the
backdoor.
The utilities provided here are designed around a specific processor family and
core; unfortunately, the tools will miss the backdoor if it has been even
slightly modified from the researched form.
Some systems have the backdoor enabled by default, allowing unprivileged code to
gain kernel level access without permission. If the steps in ‘Checking your
CPU’ indicate that your CPU is vulnerable, you can install a script to close the
backdoor early in the boot process:
Note that, even with this, an attacker with kernel level access can still
re-enable the backdoor. This script is provided as an outline for correcting
the issue during the boot process, but will require adaptation for different
systems.
Thesandsifterutility is used
extensively in this research for uncovering unknown instructions.
The details and implications presented in this work are the authors’ inferences
and opinions, derived from the research described. The research is performed
and provided with the goal of identifying and fixing a perceived security
vulnerability on the described CPUs. VIA processors are renowned for
their low power usage and excellence in embedded designs; we believe that the
functionality described was created in good faith as a useful feature for the
embedded market, and was unintentionally left enabled on some early generations
of the processor. No malicious intent is implied.
project:rosenbridge is a research effort from Christopher Domas
(@xoreaxeaxeax).
Hardware backdoors in some x86 CPUs