{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-07-26T00:00:00", "descriptions": [{"lang": "en", "value": "Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-04-11T09:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://openwall.com/lists/oss-security/2017/07/27/2"}, {"name": "100018", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100018"}, {"name": "RHSA-2018:0849", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0849"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-11671", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://openwall.com/lists/oss-security/2017/07/27/2", "refsource": "CONFIRM", "url": "http://openwall.com/lists/oss-security/2017/07/27/2"}, {"name": "100018", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100018"}, {"name": "RHSA-2018:0849", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0849"}, {"name": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180", "refsource": "CONFIRM", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180"}, {"name": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html", "refsource": "CONFIRM", "url": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:12:40.692Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2017/07/27/2"}, {"name": "100018", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/100018"}, {"name": "RHSA-2018:0849", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0849"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-11671", "datePublished": "2017-07-26T21:00:00", "dateReserved": "2017-07-26T00:00:00", "dateUpdated": "2024-08-05T18:12:40.692Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:gcc:4.6:*:*:*:*:*:*:*", "matchCriteriaId": "432D419B-7C47-432B-90CC-CBAD7112FD1F", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:4.7:*:*:*:*:*:*:*", "matchCriteriaId": "B01EDC85-552A-47B3-9801-99E6D033884E", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:4.8:*:*:*:*:*:*:*", "matchCriteriaId": "5B242A15-371A-4FB7-9515-46DDA6E07C82", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:4.9:*:*:*:*:*:*:*", "matchCriteriaId": "B1DDA9FF-4383-4E66-8945-41BB25C6C04E", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "4C86C936-3E2E-4E89-A3A4-3E77EF1AE761", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:5.1:*:*:*:*:*:*:*", "matchCriteriaId": "1DF2D5BD-B28C-43A2-A990-21F5ECB1C570", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:5.2:*:*:*:*:*:*:*", "matchCriteriaId": "4D100A33-D544-4613-893B-5BBA013DB2D3", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:5.3:*:*:*:*:*:*:*", "matchCriteriaId": "B1EE4B8E-1E82-415D-950D-13750B99E081", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:5.4:*:*:*:*:*:*:*", "matchCriteriaId": "57D66615-998F-4FDA-A1E2-E203E95D55DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "D812A692-BBCE-469F-9EA3-DFC0C43B347C", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:6.1:*:*:*:*:*:*:*", "matchCriteriaId": "54A4004B-67A0-4677-BC78-3019B14E3C75", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:6.2:*:*:*:*:*:*:*", "matchCriteriaId": "DC6A4748-7738-4259-9B4A-D013CFCCA7F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:gcc:6.3:*:*:*:*:*:*:*", "matchCriteriaId": "6CD09C4A-59C9-4852-BF74-BAF72F4EDA4E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation."}, {"lang": "es", "value": "Bajo ciertas circunstancias, la funci\u00f3n ix86_expand_builtin en el archivo i386.c en GNU Compiler Collection (GCC) versiones 4.6, 4.7, 4.8, 4.9, versi\u00f3n 5 anterior a 5.5 y versi\u00f3n 6 anterior a 6.4, generar\u00e1 secuencias de instrucciones que marcar\u00e1n el flag status de los intr\u00ednsecos RDRAND y RDSEED antes de que se pueda leer, es posible que no se denuncien los fallos de estas instrucciones. Esto podr\u00eda potencialmente conllevar a una menor aleatoriedad en la generaci\u00f3n de n\u00fameros aleatorios."}], "id": "CVE-2017-11671", "lastModified": "2024-11-21T03:08:16.397", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-07-26T21:29:00.207", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/07/27/2"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100018"}, {"source": "cve@mitre.org", "url": "https://access.redhat.com/errata/RHSA-2018:0849"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180"}, {"source": "cve@mitre.org", "tags": ["Mailing List"], "url": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/07/27/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100018"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2018:0849"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2018:0849", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "gcc-0:4.8.5-28.el7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2018-04-10T00:00:00Z"}], "bugzilla": {"description": "gcc: GCC generates incorrect code for RDRAND/RDSEED intrinsics", "id": "1475733", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1475733"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "verified"}, "details": ["Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation."], "name": "CVE-2017-11671", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "compat-gcc-295", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "compat-gcc-296", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "compat-gcc-32", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "compat-gcc-34", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "gcc", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "gcc44", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "compat-gcc-295", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "compat-gcc-296", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "compat-gcc-32", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "compat-gcc-34", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "gcc", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "compat-gcc-34", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "compat-gcc-44", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2017-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-11671\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-11671"], "threat_severity": "Low", "upstream_fix": "gcc 5.5, gcc 6.4"}