Use of cryptographically weak PRNG in Gnu Compiler Collection - CVE-2017-11671

Vulnerability identifier: #VU12267

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11671

CWE-ID: CWE-338

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists in the ix86_expand_builtin function in i386.c due to generating of instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. A remote attacker can trigger less randomness in random number generation and gain access to potentially sensitive information.

Gnu Compiler Collection
Isolation Segment
VMware Tanzu Application Service for VMs
Red Hat Virtualization Host
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Ubuntu
Fedora
gnat-5 (Ubuntu package)
gcc-5 (Ubuntu package)
gcj-5-jdk (Ubuntu package)
gccgo-6 (Ubuntu package)
gccgo-5 (Ubuntu package)
gcj-5-jre-headless (Ubuntu package)
gfortran-5 (Ubuntu package)
g++-5 (Ubuntu package)
gcj-5 (Ubuntu package)
gdc-5 (Ubuntu package)
gcc-python-plugin
libtool
gcc
Tanzu Greenplum for Kubernetes
VMware Tanzu Operations Manager

Update to versions 5.5 or 6.4.

gnat-5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gcc-5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gcj-5-jdk (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gccgo-6 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gccgo-5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gcj-5-jre-headless (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gfortran-5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
g++-5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gcj-5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gdc-5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
gcc-python-plugin - update to 0.15-8.2.fc25
Tanzu Greenplum for Kubernetes - update to 2.0.0
libtool - update to 2.4.6-14.fc25
VMware Tanzu Operations Manager - update to 2.10.52
gcc - update to 6.4.1-1.fc25

• https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180

• Information disclosure in Gnu Compiler Collection
• Red Hat update for gcc
• Ubuntu update for gcc-5
• VMware Tanzu products update for GNU gcc
• Fedora 25 update for gcc, gcc-python-plugin, libtool