diff options
Diffstat (limited to 'results/scraper/gitlab')
6 files changed, 169 insertions, 0 deletions
diff --git a/results/scraper/gitlab/semantic_issues/gitlab_semantic_addsubps b/results/scraper/gitlab/semantic_issues/gitlab_semantic_addsubps new file mode 100644 index 000000000..60438ff08 --- /dev/null +++ b/results/scraper/gitlab/semantic_issues/gitlab_semantic_addsubps @@ -0,0 +1,23 @@ +x86 SSE/SSE2/SSE3 instruction semantic bugs with NaN + +Description of problem +The result of SSE/SSE2/SSE3 instructions with NaN is different from the CPU. From Intel manual Volume 1 Appendix D.4.2.2, they defined the behavior of such instructions with NaN. But I think QEMU did not implement this semantic exactly because the byte result is different. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x000000007fffffff; push rax; mov rax, 0x00000000ffffffff; push rax; movdqu XMM1, [rsp];"); + asm("mov rax, 0x2e711de7aa46af1a; push rax; mov rax, 0x7fffffff7fffffff; push rax; movdqu XMM2, [rsp];"); + asm("addsubps xmm1, xmm2"); +} + +Execute and compare the result with the CPU. This problem happens with other SSE/SSE2/SSE3 instructions specified in the manual, Volume 1 Appendix D.4.2.2. + +CPU xmm1[3] = 0xffffffff + +QEMU xmm1[3] = 0x7fffffff + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/scraper/gitlab/semantic_issues/gitlab_semantic_adox b/results/scraper/gitlab/semantic_issues/gitlab_semantic_adox new file mode 100644 index 000000000..9f4471c9a --- /dev/null +++ b/results/scraper/gitlab/semantic_issues/gitlab_semantic_adox @@ -0,0 +1,36 @@ +x86 ADOX and ADCX semantic bug +Description of problem +The result of instruction ADOX and ADCX are different from the CPU. The value of one of EFLAGS is different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("push 512; popfq;"); + asm("mov rax, 0xffffffff84fdbf24"); + asm("mov rbx, 0xb197d26043bec15d"); + asm("adox eax, ebx"); +} + + + +Execute and compare the result with the CPU. This problem happens with ADCX, too (with CF). + +CPU + +OF = 0 + + +QEMU + +OF = 1 + + + + + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/scraper/gitlab/semantic_issues/gitlab_semantic_bextr b/results/scraper/gitlab/semantic_issues/gitlab_semantic_bextr new file mode 100644 index 000000000..dabe16acf --- /dev/null +++ b/results/scraper/gitlab/semantic_issues/gitlab_semantic_bextr @@ -0,0 +1,25 @@ +x86 BEXTR semantic bug +Description of problem +The result of instruction BEXTR is different with from the CPU. The value of destination register is different. I think QEMU does not consider the operand size limit. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x17b3693f77fb6e9"); + asm("mov rbx, 0x8f635a775ad3b9b4"); + asm("mov rcx, 0xb717b75da9983018"); + asm("bextr eax, ebx, ecx"); +} + +Execute and compare the result with the CPU. + +CPU +RAX = 0x5a + +QEMU +RAX = 0x635a775a + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/scraper/gitlab/semantic_issues/gitlab_semantic_blsi b/results/scraper/gitlab/semantic_issues/gitlab_semantic_blsi new file mode 100644 index 000000000..92ff92b0e --- /dev/null +++ b/results/scraper/gitlab/semantic_issues/gitlab_semantic_blsi @@ -0,0 +1,20 @@ +x86 BLSI and BLSR semantic bug +Description of problem +The result of instruction BLSI and BLSR is different from the CPU. The value of CF is different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("blsi rax, rbx"); +} + + + +Execute and compare the result with the CPU. The value of CF is exactly the opposite. This problem happens with BLSR, too. + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/scraper/gitlab/semantic_issues/gitlab_semantic_blsmsk b/results/scraper/gitlab/semantic_issues/gitlab_semantic_blsmsk new file mode 100644 index 000000000..b950faa21 --- /dev/null +++ b/results/scraper/gitlab/semantic_issues/gitlab_semantic_blsmsk @@ -0,0 +1,27 @@ +x86 BLSMSK semantic bug +Description of problem +The result of instruction BLSMSK is different with from the CPU. The value of CF is different. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x65b2e276ad27c67"); + asm("mov rbx, 0x62f34955226b2b5d"); + asm("blsmsk eax, ebx"); +} + +Execute and compare the result with the CPU. + +CPU + +CF = 0 + + +QEMU + +CF = 1 + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/scraper/gitlab/semantic_issues/gitlab_semantic_bzhi b/results/scraper/gitlab/semantic_issues/gitlab_semantic_bzhi new file mode 100644 index 000000000..b86da08c7 --- /dev/null +++ b/results/scraper/gitlab/semantic_issues/gitlab_semantic_bzhi @@ -0,0 +1,38 @@ +x86 BZHI semantic bug +Description of problem +The result of instruction BZHI is different from the CPU. The value of destination register and SF of EFLAGS are different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("mov rax, 0xb1aa9da2fe33fe3"); + asm("mov rbx, 0x80000000ffffffff"); + asm("mov rcx, 0xf3fce8829b99a5c6"); + asm("bzhi rax, rbx, rcx"); +} + + + +Execute and compare the result with the CPU. + +CPU + +RAX = 0x0x80000000ffffffff +SF = 1 + + +QEMU + +RAX = 0xffffffff +SF = 0 + + + + + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. |