diff options
Diffstat (limited to 'results/classifier/zero-shot/011/semantic')
6 files changed, 343 insertions, 0 deletions
diff --git a/results/classifier/zero-shot/011/semantic/gitlab_semantic_addsubps b/results/classifier/zero-shot/011/semantic/gitlab_semantic_addsubps new file mode 100644 index 00000000..e045ffee --- /dev/null +++ b/results/classifier/zero-shot/011/semantic/gitlab_semantic_addsubps @@ -0,0 +1,52 @@ +semantic: 0.513 +other: 0.170 +device: 0.065 +debug: 0.047 +graphic: 0.035 +vnc: 0.027 +performance: 0.024 +permissions: 0.024 +PID: 0.021 +files: 0.020 +boot: 0.017 +socket: 0.015 +network: 0.013 +KVM: 0.009 +semantic: 0.848 +debug: 0.039 +files: 0.020 +other: 0.019 +PID: 0.013 +performance: 0.011 +network: 0.009 +device: 0.007 +permissions: 0.007 +boot: 0.007 +socket: 0.006 +vnc: 0.005 +graphic: 0.005 +KVM: 0.004 + +x86 SSE/SSE2/SSE3 instruction semantic bugs with NaN + +Description of problem +The result of SSE/SSE2/SSE3 instructions with NaN is different from the CPU. From Intel manual Volume 1 Appendix D.4.2.2, they defined the behavior of such instructions with NaN. But I think QEMU did not implement this semantic exactly because the byte result is different. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x000000007fffffff; push rax; mov rax, 0x00000000ffffffff; push rax; movdqu XMM1, [rsp];"); + asm("mov rax, 0x2e711de7aa46af1a; push rax; mov rax, 0x7fffffff7fffffff; push rax; movdqu XMM2, [rsp];"); + asm("addsubps xmm1, xmm2"); +} + +Execute and compare the result with the CPU. This problem happens with other SSE/SSE2/SSE3 instructions specified in the manual, Volume 1 Appendix D.4.2.2. + +CPU xmm1[3] = 0xffffffff + +QEMU xmm1[3] = 0x7fffffff + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/011/semantic/gitlab_semantic_adox b/results/classifier/zero-shot/011/semantic/gitlab_semantic_adox new file mode 100644 index 00000000..eedacd67 --- /dev/null +++ b/results/classifier/zero-shot/011/semantic/gitlab_semantic_adox @@ -0,0 +1,65 @@ +semantic: 0.658 +device: 0.057 +other: 0.049 +graphic: 0.039 +debug: 0.037 +vnc: 0.027 +permissions: 0.024 +boot: 0.020 +performance: 0.017 +PID: 0.017 +files: 0.017 +socket: 0.015 +network: 0.014 +KVM: 0.008 +semantic: 0.837 +debug: 0.071 +other: 0.019 +files: 0.016 +performance: 0.013 +PID: 0.008 +device: 0.007 +KVM: 0.005 +network: 0.005 +graphic: 0.004 +permissions: 0.004 +boot: 0.004 +socket: 0.004 +vnc: 0.002 + +x86 ADOX and ADCX semantic bug +Description of problem +The result of instruction ADOX and ADCX are different from the CPU. The value of one of EFLAGS is different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("push 512; popfq;"); + asm("mov rax, 0xffffffff84fdbf24"); + asm("mov rbx, 0xb197d26043bec15d"); + asm("adox eax, ebx"); +} + + + +Execute and compare the result with the CPU. This problem happens with ADCX, too (with CF). + +CPU + +OF = 0 + + +QEMU + +OF = 1 + + + + + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/011/semantic/gitlab_semantic_bextr b/results/classifier/zero-shot/011/semantic/gitlab_semantic_bextr new file mode 100644 index 00000000..ae41ff1b --- /dev/null +++ b/results/classifier/zero-shot/011/semantic/gitlab_semantic_bextr @@ -0,0 +1,54 @@ +semantic: 0.694 +graphic: 0.050 +device: 0.049 +debug: 0.048 +other: 0.028 +permissions: 0.024 +vnc: 0.021 +boot: 0.016 +PID: 0.015 +performance: 0.014 +socket: 0.014 +files: 0.013 +network: 0.010 +KVM: 0.005 +semantic: 0.759 +debug: 0.145 +other: 0.020 +files: 0.017 +performance: 0.012 +PID: 0.009 +device: 0.008 +network: 0.007 +permissions: 0.004 +socket: 0.004 +KVM: 0.004 +graphic: 0.004 +boot: 0.004 +vnc: 0.003 + +x86 BEXTR semantic bug +Description of problem +The result of instruction BEXTR is different with from the CPU. The value of destination register is different. I think QEMU does not consider the operand size limit. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x17b3693f77fb6e9"); + asm("mov rbx, 0x8f635a775ad3b9b4"); + asm("mov rcx, 0xb717b75da9983018"); + asm("bextr eax, ebx, ecx"); +} + +Execute and compare the result with the CPU. + +CPU +RAX = 0x5a + +QEMU +RAX = 0x635a775a + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/011/semantic/gitlab_semantic_blsi b/results/classifier/zero-shot/011/semantic/gitlab_semantic_blsi new file mode 100644 index 00000000..048c9544 --- /dev/null +++ b/results/classifier/zero-shot/011/semantic/gitlab_semantic_blsi @@ -0,0 +1,49 @@ +semantic: 0.512 +other: 0.112 +graphic: 0.072 +device: 0.051 +vnc: 0.039 +permissions: 0.030 +files: 0.028 +debug: 0.027 +performance: 0.026 +boot: 0.026 +socket: 0.025 +network: 0.023 +PID: 0.018 +KVM: 0.012 +semantic: 0.826 +debug: 0.055 +other: 0.025 +performance: 0.020 +files: 0.018 +PID: 0.011 +device: 0.008 +network: 0.006 +permissions: 0.006 +KVM: 0.006 +boot: 0.006 +graphic: 0.005 +socket: 0.004 +vnc: 0.003 + +x86 BLSI and BLSR semantic bug +Description of problem +The result of instruction BLSI and BLSR is different from the CPU. The value of CF is different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("blsi rax, rbx"); +} + + + +Execute and compare the result with the CPU. The value of CF is exactly the opposite. This problem happens with BLSR, too. + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/011/semantic/gitlab_semantic_blsmsk b/results/classifier/zero-shot/011/semantic/gitlab_semantic_blsmsk new file mode 100644 index 00000000..7a28beaa --- /dev/null +++ b/results/classifier/zero-shot/011/semantic/gitlab_semantic_blsmsk @@ -0,0 +1,56 @@ +semantic: 0.630 +other: 0.057 +device: 0.057 +graphic: 0.046 +permissions: 0.033 +vnc: 0.028 +debug: 0.027 +boot: 0.023 +socket: 0.022 +files: 0.021 +performance: 0.016 +network: 0.016 +PID: 0.014 +KVM: 0.009 +semantic: 0.837 +debug: 0.070 +other: 0.017 +files: 0.015 +performance: 0.013 +device: 0.008 +PID: 0.008 +KVM: 0.006 +network: 0.006 +permissions: 0.005 +socket: 0.005 +boot: 0.004 +graphic: 0.004 +vnc: 0.003 + +x86 BLSMSK semantic bug +Description of problem +The result of instruction BLSMSK is different with from the CPU. The value of CF is different. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x65b2e276ad27c67"); + asm("mov rbx, 0x62f34955226b2b5d"); + asm("blsmsk eax, ebx"); +} + +Execute and compare the result with the CPU. + +CPU + +CF = 0 + + +QEMU + +CF = 1 + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/011/semantic/gitlab_semantic_bzhi b/results/classifier/zero-shot/011/semantic/gitlab_semantic_bzhi new file mode 100644 index 00000000..24419a0f --- /dev/null +++ b/results/classifier/zero-shot/011/semantic/gitlab_semantic_bzhi @@ -0,0 +1,67 @@ +semantic: 0.534 +device: 0.090 +graphic: 0.089 +debug: 0.048 +other: 0.042 +vnc: 0.033 +permissions: 0.026 +performance: 0.026 +boot: 0.023 +PID: 0.021 +socket: 0.020 +network: 0.020 +files: 0.020 +KVM: 0.009 +semantic: 0.852 +debug: 0.057 +other: 0.017 +files: 0.014 +performance: 0.013 +PID: 0.008 +device: 0.008 +network: 0.005 +KVM: 0.005 +socket: 0.005 +permissions: 0.005 +boot: 0.004 +graphic: 0.004 +vnc: 0.003 + +x86 BZHI semantic bug +Description of problem +The result of instruction BZHI is different from the CPU. The value of destination register and SF of EFLAGS are different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("mov rax, 0xb1aa9da2fe33fe3"); + asm("mov rbx, 0x80000000ffffffff"); + asm("mov rcx, 0xf3fce8829b99a5c6"); + asm("bzhi rax, rbx, rcx"); +} + + + +Execute and compare the result with the CPU. + +CPU + +RAX = 0x0x80000000ffffffff +SF = 1 + + +QEMU + +RAX = 0xffffffff +SF = 0 + + + + + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. |