Vulnerable Hardware Design Dataset

This repository contains a collection of vulnerable hardware design examples stored in a JSON Lines (JSONL) file format. Each line in the file represents a single vulnerability entry in JSON format, making it easy to process and analyze programmatically. Our top-performing model is now accessible on the Hugging Face platform for the research community. You can explore it here: [https://huggingface.co/shamstarek/Mistral-7B-instruct-Bug-Whisperer]

JSONL File Format Overview

Each JSON object in the file contains three primary keys:

• Module:
  This key holds the original code snippet along with the corresponding instructions. The content is delimited using [INST] and [\INST] markers. It typically includes the instructions for performing a security analysis on the code snippet.

• Explanation:
  This field provides the security analysis of the code snippet. It details the vulnerability and explains any flaws or potential risks (e.g., bypassing authentication logic) that were identified during the analysis.

• Total:
  This key aggregates the full entry by combining the instruction, the code snippet (usually in a code block format), and the detailed explanation. It serves as a complete record of both the task and the outcome of the analysis.

  Example Entry

Here is an example of a single JSON object from the file:

{
  "Module": "[INST]\nInstruction: Perform security analysis of the code snippet and report any bug you find with proper explanation.\nmodule password_verification\n  AuthCheckState: begin        \n    if(isHashVerified) begin            \n      if(inputHash == storedHash) begin             \n        authenticationStatus = 1'b1;           \n      end \n      else begin             \n        authenticationStatus = 1'b0;           \n      end           \n      nextState = WaitForInput;         \n    end \n    else begin           \n      nextState = AuthCheckState;         \n    end         \n  end\nendmodule\n[\\INST]",
  "Explanation": "Explanation\n: This code snippet suffers from a flawed authentication logic where the outcome of the authenticationStatus is disregarded as the system transitions to a waiting state regardless of the authentication result. This flaw could potentially allow unauthorized access to the system by ignoring the result of a failed authentication attempt, thus posing a serious security risk by enabling an attacker to bypass the authentication mechanism.",
  "Total": "[INST]\nInstruction: Perform security analysis of the code snippet and report any bug you find with proper explanation.\n```verilog\nmodule password_verification\n  AuthCheckState: begin        \n    if(isHashVerified) begin            \n      if(inputHash == storedHash) begin             \n        authenticationStatus = 1'b1;           \n      end \n      else begin             \n        authenticationStatus = 1'b0;           \n      end           \n      nextState = WaitForInput;         \n    end \n    else begin           \n      nextState = AuthCheckState;         \n    end         \n  end\nendmodule\n```\n\nExplanation: This code snippet suffers from a flawed authentication logic where the outcome of the authenticationStatus is disregarded as the system transitions to a waiting state regardless of the authentication result. This flaw could potentially allow unauthorized access to the system by ignoring the result of a failed authentication attempt, thus posing a serious security risk by enabling an attacker to bypass the authentication mechanism.\n[\\INST]"
}