project:rosenbridge reveals a hardware backdoor in some desktop, laptop, and embedded x86 processors. The backdoor lets ring 3 (userland) code bypass processor protections and freely read or write ring 0 (kernel) data. While the backdoor is normally disabled (requiring kernel execution to enable it), it is enabled by default on some systems.

The hidden core is a small, non‑x86 processor embedded alongside the main x86 core, activated via a model‑specific‑register control bit and a launch instruction, then fed commands through a custom Deeply Embedded Instruction Set (DEIS) that ignores all memory protections and privilege checks. The issue affects only VIA C3 CPUs, which are used in industrial automation, POS terminals, ATMs, healthcare hardware, and consumer computers. Generations after the C3 no longer contain this feature.

Researchers can check for the backdoor using the provided utility on bare metal, and if vulnerable, install an early‑boot script to close the MSR bit—though a kernel‑level attacker could re‑enable it. The repository includes assemblers, fuzzers, and a stripped‑down sandsifter to explore the hidden core. This work, led by Christopher Domas, serves as a case study on how backdoors can emerge in complex processors and offers tools for deeper vulnerability research.