cnvd - cnvd-2017-26345

cnvd-2017-26345

Vulnerability from cnvd

Title: GNU GCC不安全随机数生成器漏洞

Description:

GNU gcc（GNU Compiler Collection，GNU编译器套装）是GNU计划开发的一款开源的编程语言编译器。

GNU GCC存在不安全随机数生成器漏洞。攻击者可以利用漏洞获取访问权限以执行某些未经授权的操作。

Severity: 低

Patch Name: GNU GCC不安全随机数生成器漏洞的补丁

Patch Description:

GNU gcc（GNU Compiler Collection，GNU编译器套装）是GNU计划开发的一款开源的编程语言编译器。

GNU GCC存在不安全随机数生成器漏洞。攻击者可以利用漏洞获取访问权限以执行某些未经授权的操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可联系供应商获得补丁信息： https://gcc.gnu.org/

Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-11671

Impacted products

Name
['GNU Compiler Collection (GCC) 4.6', 'GNU Compiler Collection (GCC) 4.7', 'GNU Compiler Collection (GCC) 4.8', 'GNU Compiler Collection (GCC) 4.9', 'GNU Compiler Collection (GCC) >=5，<=5.5', 'GNU Compiler Collection (GCC) >=6，<=6.4']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "100018"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-11671"
    }
  },
  "description": "GNU gcc\uff08GNU Compiler Collection\uff0cGNU\u7f16\u8bd1\u5668\u5957\u88c5\uff09\u662fGNU\u8ba1\u5212\u5f00\u53d1\u7684\u4e00\u6b3e\u5f00\u6e90\u7684\u7f16\u7a0b\u8bed\u8a00\u7f16\u8bd1\u5668\u3002 \r\n\r\nGNU GCC\u5b58\u5728\u4e0d\u5b89\u5168\u968f\u673a\u6570\u751f\u6210\u5668\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u83b7\u53d6\u8bbf\u95ee\u6743\u9650\u4ee5\u6267\u884c\u67d0\u4e9b\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c\u3002",
  "discovererName": "Todd Eisenberger",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://gcc.gnu.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-26345",
  "openTime": "2017-09-12",
  "patchDescription": "GNU gcc\uff08GNU Compiler Collection\uff0cGNU\u7f16\u8bd1\u5668\u5957\u88c5\uff09\u662fGNU\u8ba1\u5212\u5f00\u53d1\u7684\u4e00\u6b3e\u5f00\u6e90\u7684\u7f16\u7a0b\u8bed\u8a00\u7f16\u8bd1\u5668\u3002 \r\n\r\nGNU GCC\u5b58\u5728\u4e0d\u5b89\u5168\u968f\u673a\u6570\u751f\u6210\u5668\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u83b7\u53d6\u8bbf\u95ee\u6743\u9650\u4ee5\u6267\u884c\u67d0\u4e9b\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "GNU GCC\u4e0d\u5b89\u5168\u968f\u673a\u6570\u751f\u6210\u5668\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "GNU Compiler Collection (GCC) 4.6",
      "GNU Compiler Collection (GCC) 4.7",
      "GNU Compiler Collection (GCC) 4.8",
      "GNU Compiler Collection (GCC) 4.9",
      "GNU Compiler Collection (GCC) \u003e=5\uff0c\u003c=5.5",
      "GNU Compiler Collection (GCC) \u003e=6\uff0c\u003c=6.4"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-11671",
  "serverity": "\u4f4e",
  "submitTime": "2017-07-27",
  "title": "GNU GCC\u4e0d\u5b89\u5168\u968f\u673a\u6570\u751f\u6210\u5668\u6f0f\u6d1e"
}

CVE-2017-11671 (GCVE-0-2017-11671)

Vulnerability from cvelistv5

Published

2017-07-26 21:00

Modified

2024-08-05 18:12

Severity ?

CWE

Summary

Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.

References

▼	URL	Tags
	http://openwall.com/lists/oss-security/2017/07/27/2	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/100018	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:0849	vendor-advisory, x_refsource_REDHAT
	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180	x_refsource_CONFIRM
	https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:12:40.692Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2017/07/27/2"
          },
          {
            "name": "100018",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100018"
          },
          {
            "name": "RHSA-2018:0849",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0849"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-07-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-04-11T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://openwall.com/lists/oss-security/2017/07/27/2"
        },
        {
          "name": "100018",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100018"
        },
        {
          "name": "RHSA-2018:0849",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0849"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-11671",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://openwall.com/lists/oss-security/2017/07/27/2",
              "refsource": "CONFIRM",
              "url": "http://openwall.com/lists/oss-security/2017/07/27/2"
            },
            {
              "name": "100018",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100018"
            },
            {
              "name": "RHSA-2018:0849",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0849"
            },
            {
              "name": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180",
              "refsource": "CONFIRM",
              "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180"
            },
            {
              "name": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html",
              "refsource": "CONFIRM",
              "url": "https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-11671",
    "datePublished": "2017-07-26T21:00:00",
    "dateReserved": "2017-07-26T00:00:00",
    "dateUpdated": "2024-08-05T18:12:40.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted