Vulnerability in GNU Gcc
CVE-2017-11671
Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.
EPSS: 0.004 (36.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.0 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Gnu Gcc — versions 4.6, 4.7, 4.8
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM, Mailing List, Third Party Advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Mailing List)
Frequently asked questions
- What is CVE-2017-11671?
- CVE-2017-11671 is a medium-severity vulnerability in GNU Gcc, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 4.0/10. Published 2017-07-26.
- How severe is CVE-2017-11671?
- Medium severity. CVSS v3 base score is 4.0 out of 10.
- Is CVE-2017-11671 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.