GNU GCC CVE-2017-11671 Insecure Random Number Generator Weakness

Bugtraq ID:	100018
Class:	Design Error
CVE:	CVE-2017-11671
Remote:	Yes
Local:	No
Published:	Jul 26 2017 12:00AM
Updated:	Jul 26 2017 12:00AM
Credit:	Todd Eisenberger
Vulnerable:	GNU gcc 6.3 GNU gcc 6 GNU gcc 5.4 GNU gcc 5 GNU gcc 4.9 GNU gcc 4.8 GNU gcc 4.7 GNU gcc 4.6
Not Vulnerable:	GNU gcc 6.4 GNU gcc 5.5

GNU GCC CVE-2017-11671 Insecure Random Number Generator Weakness

GNU GCC is prone to an insecure random number generator weakness.

An attacker can exploit this issue to gain access to perform certain unauthorized actions; this may lead to further attacks.

GNU Compiler Collection (GCC) 4.6, 4.7, 4.8, 4.9, 5 through 5.5, and 6 through 6.4 are vulnerable.

GNU GCC CVE-2017-11671 Insecure Random Number Generator Weakness

An attacker can exploit this issue using readily available tools.

GNU GCC CVE-2017-11671 Insecure Random Number Generator Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GNU GCC CVE-2017-11671 Insecure Random Number Generator Weakness

References:

• GCC Home Page (GNU)
  
• [PATCH, i386]: Fix PR 80180, Incorrect codegen from rdseed intrinsic use (GNU)
  
• Bug 1475733 -CVE-2017-11671 gcc: GCC generates incorrect code for RDRAND/RDSEED (Redhat)
  
• Bug 80180 (CVE-2017-11671) - Incorrect codegen from rdseed intrinsic use (GNU)
  
• CVE-2017-11671 (Redhat)
  
• Oracle Linux Bulletin - April 2018 (Oracle)