Wind River Support Network

HomeDefectsLIN9-4793

Fixed

LIN9-4793 : Security Advisory - gcc - CVE-2017-11671

Created: Jul 27, 2017 Updated: May 29, 2018

Resolved Date: Sep 13, 2017

Found In Version: 9.0.0.8

Fix Version: 9.0.0.11

Severity: Standard

Applicable for: Wind River Linux 9

Component/s: Toolchain

Description

Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported.

https://nvd.nist.gov/vuln/detail/CVE-2017-11671

-----

Earlier this year, a GCC bug was fixed which could lead to intrinsics
for RDRAND and (more likely) RDSEED to produce non-random results.
These instructions use the carry flag to report success or failure,
and GCC used to generate instruction sequences which clobbered the
flag before applications had a change to read it:

  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180
  https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html

CVEs

CVE-2017-11671