安全研究员Christopher Domas发现了VIA C3处理器中的一个硬件后门漏洞，命名为Rosenbridge[1]。该后门是一个嵌入在x86核心旁边的非x86微核心，可通过特定指令激活，允许用户级代码绕过处理器保护以读写内核数据[1]。虽然后门通常需要内核级权限才能激活，但在某些系统上已默认启用[1]。
VIA C3系列处理器广泛应用于工业自动化、POS系统、ATM和医疗硬件等领域[1]。Rosenbridge协处理器相比已知的Management Engine或Platform Security Processor嵌入更深，威胁等级更高[1]。值得注意的是，后续CPU代系已不再包含此功能，漏洞范围相对有限[1]。
为应对这一安全问题，研究人员提供了检测工具和修复脚本用于关闭该后门[1]。相关代码已托管在github.com/xoreaxeaxeax/rosenbridge[1]。
Security researcher Christopher Domas has identified a hardware backdoor called Rosenbridge embedded in VIA C3 processors, enabling user-level code to bypass processor protections and access kernel data [1]. The vulnerability affects processors widely deployed in industrial automation systems, point-of-sale terminals, ATMs, and medical devices [1].
Rosenbridge operates as a non-x86 microcore positioned alongside the x86 processor core, capable of being activated through specific instructions to execute a specialized instruction set that circumvents all memory protections [1]. While the backdoor typically requires kernel-level privileges to activate, it is enabled by default on certain systems [1]. Domas has released detection and remediation tools, including a diagnostic utility and scripts to disable the backdoor, with the project code available on GitHub [1]. Notably, subsequent CPU generations no longer contain this functionality, limiting the scope of affected systems [1].