GitHub - xoreaxeaxeax/rosenbridge: Hardware backdoors in some x86 CPUs · GitHub
/" data-turbo-transient="true" />
Skip to content
Type / to search
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
xoreaxeaxeax
rosenbridge
Public
Notifications<br>You must be signed in to change notification settings
Fork<br>222
Star<br>2.4k
master
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>1 Commit<br>1 Commit
asm
asm
esc
esc
fix
fix
fuzz
fuzz
kern
kern
lock
lock
proc
proc
test
test
util
util
LICENSE
LICENSE
README.md
README.md
rosenbridge.gif
rosenbridge.gif
View all files
Repository files navigation
project:rosenbridge
: hardware backdoors in x86 CPUs
github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax
Overview
project:rosenbridge reveals a hardware backdoor in some desktop, laptop, and<br>embedded x86 processors.
The backdoor allows ring 3 (userland) code to circumvent processor protections<br>to freely read and write ring 0 (kernel) data. While the backdoor is typically<br>disabled (requiring ring 0 execution to enable it), we have found that it is<br>enabled by default on some systems.
This repository contains utilities to check if your processor is affected, close<br>the backdoor if it is present, and the research and tools used to discover and<br>analyze the backdoor.
The Backdoor
The rosenbridge backdoor is a small, non-x86 core embedded alongside the main<br>x86 core in the CPU. It is enabled by a model-specific-register control bit,<br>and then toggled with a launch-instruction. The embedded core is then fed<br>commands, wrapped in a specially formatted x86 instruction. The core executes<br>these commands (which we call the 'deeply embedded instruction set'), bypassing<br>all memory protections and privilege checks.
While the backdoor should require kernel level access to activate, it has been<br>observed to be enabled by default on some systems, allowing any unprivileged<br>code to modify the kernel.
The rosenbridge backdoor is entirely distinct from other publicly known<br>coprocessors on x86 CPUs, such as the Management Engine or Platform Security<br>Processor; it is more deeply embedded than any known coprocessor, having access<br>to not only all of the CPU's memory, but its register file and execution<br>pipeline as well.
Affected Systems
It is thought that only VIA C3 CPUs are affected by this issue. The C-series<br>processors are marketed towards industrial automation, point-of-sale, ATM, and<br>healthcare hardware, as well as a variety of consumer desktop and laptop<br>computers.
Looking Forward
The scope of this vulnerability is limited; generations of CPUs after the C3 no<br>longer contain this feature.
This work is released as a case study and thought experiment, illustrating how<br>backdoors might arise in increasingly complex processors, and how researchers<br>and end-users might identify such features. The tools and research offered<br>here provide the starting point for ever-deeper processor vulnerability<br>research.
Checking your CPU
To check if your CPU is affected:
git clone https://github.com/xoreaxeaxeax/rosenbridge<br>cd rosenbridge/util<br>make<br>sudo modprobe msr<br>sudo ./bin/check
The provided utility must be run on baremetal (not in a virtual-machine), and is<br>in an alpha state. It may crash, panic, or hang systems not containing the<br>backdoor.
The utilities provided here are designed around a specific processor family and<br>core; unfortunately, the tools will miss the backdoor if it has been even<br>slightly modified from the researched form.
Closing the Backdoor
Some systems have the backdoor enabled by default, allowing unprivileged code to<br>gain kernel level access without permission. If the steps in 'Checking your<br>CPU' indicate that your CPU is vulnerable, you can install a script to close the<br>backdoor early in the boot process:
cd fix<br>make<br>sudo make install<br>reboot
Note that, even with this, an attacker with kernel level access can still<br>re-enable the backdoor. This script is provided as an outline for correcting<br>the issue during the boot process, but will require adaptation for different<br>systems.
Tools and Techniques
The sandsifter utility is used<br>extensively in this research for uncovering unknown instructions.
asm
An assembler for the Deeply Embedded Instruction Set (DEIS). It converts<br>programs written in the custom rosenbridge assembly into x86 instructions,<br>which, when executed following the launch-instruction, will send the<br>commands to the hidden CPU core.
esc
A proof-of-concept of using the rosenbridge backdoor for privilege<br>escalation.
fix
A rough outline for closing the vulnerability on affected systems, to the<br>extent possible through model-specific-register...