CVE-2017-11671

MEDIUM

GCC 4.6-6.3 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Title source: llm
STIX 2.1

Description

Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.

References (5)

Core 5
Core References
Mailing List, Third Party Advisory x_refsource_confirm
http://openwall.com/lists/oss-security/2017/07/27/2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/100018
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0849
Issue Tracking, Vendor Advisory x_refsource_confirm
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180

Scores

CVSS v3 4.0
EPSS 0.0008
EPSS Percentile 23.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-338
Status published
Products (13)
gnu/gcc 4.6
gnu/gcc 4.7
gnu/gcc 4.8
gnu/gcc 4.9
gnu/gcc 5.0
gnu/gcc 5.1
gnu/gcc 5.2
gnu/gcc 5.3
gnu/gcc 5.4
gnu/gcc 6.0
... and 3 more
Published Jul 26, 2017
Tracked Since Feb 18, 2026