CVEvulnerability

CVE-2017-11671

4.0 MEDIUM Published 2017-07-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-07-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
4.0 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-338

Description

Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.

Affected configurations

• gnu gcc 4.6 • gnu gcc 4.7 • gnu gcc 4.8 • gnu gcc 4.9 • gnu gcc 5.0 • gnu gcc 5.1 • gnu gcc 5.2 • gnu gcc 5.3 • gnu gcc 5.4 • gnu gcc 6.0 • gnu gcc 6.1 • gnu gcc 6.2 • gnu gcc 6.3

Related

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References