製品・ソフトウェアに関する情報

JVN脆弱性詳細

GNU Compiler Collection における暗号における脆弱な PRNG の使用に関する脆弱性

Title	GNU Compiler Collection における暗号における脆弱な PRNG の使用に関する脆弱性
Summary	GNU Compiler Collection (GCC) には、暗号における脆弱な PRNG の使用に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 25, 2017, midnight
Registration Date	Sept. 4, 2017, 4:53 p.m.
Last Update	Sept. 4, 2017, 4:53 p.m.

Affected System

GNU Project

GNU GCC 4.6

GNU GCC 4.7

GNU GCC 4.8

GNU GCC 4.9

GNU GCC 5.5 未満の 5

GNU GCC 6.4 未満の 6

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-11671	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11671
National Vulnerability Database (NVD)
2	CVE-2017-11671	https://nvd.nist.gov/vuln/detail/CVE-2017-11671
関連文書
3	CVE-2017-11671: GCC generates incorrect code for RDRAND/RDSEED intrinsics	http://openwall.com/lists/oss-security/2017/07/27/2

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-338	https://cwe.mitre.org/data/definitions/338.html

ベンダー情報

No	Name	URL
GCC Bugzilla
1	Bug 80180	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180
GCC, the GNU Compiler Collection
2	[PATCH, i386]: Fix PR 80180, Incorrect codegen from rdseed intrinsic use	https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html

Change Log

No	Changed Details	Date of change
0	[2017年09月04日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-11671

Summary	Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.
Publication Date	July 27, 2017, 6:29 a.m.
Registration Date	Jan. 26, 2021, 1:13 p.m.
Last Update	Nov. 21, 2024, 12:08 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://openwall.com/lists/oss-security/2017/07/27/2	Mailing List Third Party Advisory
2	http://openwall.com/lists/oss-security/2017/07/27/2	Mailing List Third Party Advisory
3	http://www.securityfocus.com/bid/100018	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/100018	Third Party Advisory VDB Entry
5	https://access.redhat.com/errata/RHSA-2018:0849
6	https://access.redhat.com/errata/RHSA-2018:0849
7	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180	Issue Tracking Vendor Advisory
8	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180	Issue Tracking Vendor Advisory
9	https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html	Mailing List
10	https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html	Mailing List

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-338	暗号における脆弱な PRNG の使用	https://cwe.mitre.org/data/definitions/338.html