CVE-2017-11671
Summary
| CVE | CVE-2017-11671 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-07-26 21:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation. |
Risk And Classification
Primary CVSS: v3.0 4 MEDIUM from [email protected]
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Problem Types: CWE-338 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 4 | MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 2.0 | [email protected] | Primary | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
CVSS v3.0 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:L/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Gnu | Gcc | 4.6 | All | All | All |
| Application | Gnu | Gcc | 4.7 | All | All | All |
| Application | Gnu | Gcc | 4.8 | All | All | All |
| Application | Gnu | Gcc | 4.9 | All | All | All |
| Application | Gnu | Gcc | 5.0 | All | All | All |
| Application | Gnu | Gcc | 5.1 | All | All | All |
| Application | Gnu | Gcc | 5.2 | All | All | All |
| Application | Gnu | Gcc | 5.3 | All | All | All |
| Application | Gnu | Gcc | 5.4 | All | All | All |
| Application | Gnu | Gcc | 6.0 | All | All | All |
| Application | Gnu | Gcc | 6.1 | All | All | All |
| Application | Gnu | Gcc | 6.2 | All | All | All |
| Application | Gnu | Gcc | 6.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - CVE-2017-11671: GCC generates incorrect code for RDRAND/RDSEED intrinsics | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Mailing List, Third Party Advisory |
| Uros Bizjak - [PATCH, i386]: Fix PR 80180, Incorrect codegen from rdseed intrinsic use | af854a3a-2127-422b-91ae-364da2661108 | gcc.gnu.org | Mailing List |
| 80180 – (CVE-2017-11671) Incorrect codegen from rdseed intrinsic use (CVE-2017-11671) | af854a3a-2127-422b-91ae-364da2661108 | gcc.gnu.org | Issue Tracking, Vendor Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| GNU GCC CVE-2017-11671 Insecure Random Number Generator Weakness | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.