Cool article. I didn't understand how the privilege escalation would be exploited. Obviously if the attacker already has access to the box, he can get root with this exploit. I think a chip backdoor could also be based on information leaking rather than executing arbitrary code. The steps would be: 1. Identify critical info, like crypto keys, from heuristics. This means keeping a special buffer, since you don't know…
1. You design your CPU so whenever you execute an add instruction with $r1 = x, $r2 = y (say these are the add inputs), the next add instruction will switch to ring-0 mode and run code at address which is the result of the add. 2. You don't need access to the box. You just get the target to load a site with JS that sets x and y to those specfic values and adds them, and then adds zero to some address you want to exec…
I'm not clear on the "million tricks" though. Suppose you embed some machine language in a string javascript, and use your r1/r2 trick - how can you compute the address of the machine language you want to execute?
Or are you saying there are existing chunks of machine language in the OS or apps that would be useful to remote execute, with no arguments?