Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5770-1 advisory.

    Todd Eisenberger discovered that certain versions of GNU Compiler Collection (GCC) could be made to     clobber the status flag of RDRAND and RDSEED with specially crafted input. This could potentially lead to     less randomness in random number generation.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has gcc packages installed that are affected by a vulnerability:

  - Under certain circumstances, the ix86_expand_builtin     function in i386.c in GNU Compiler Collection (GCC)     version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before     6.4 will generate instruction sequences that clobber the     status flag of the RDRAND and RDSEED intrinsics before     it can be read, potentially causing failures of these     instructions to go unreported. This could potentially     lead to less randomness in random number generation.
    (CVE-2017-11671)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the gcc package has been released.

According to the versions of the gcc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The gcc package contains the GNU Compiler Collection     version 4.8.You'll need this package in order to     compile C code.

  - Security fix(es):

  - Under certain circumstances, the ix86_expand_builtin     function in i386.c in GNU Compiler Collection (GCC)     version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before     6.4 will generate instruction sequences that clobber     the status flag of the RDRAND and RDSEED intrinsics     before it can be read, potentially causing failures of     these instructions to go unreported. This could     potentially lead to less randomness in random number     generation.(CVE-2017-11671)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The gcc package contains the GNU Compiler Collection     version 4.8.You'll need this package in order to     compile C code.

  - Security fix(es):

  - Under certain circumstances, the ix86_expand_builtin     function in i386.c in GNU Compiler Collection (GCC)     version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before     6.4 will generate instruction sequences that clobber     the status flag of the RDRAND and RDSEED intrinsics     before it can be read, potentially causing failures of     these instructions to go unreported. This could     potentially lead to less randomness in random number     generation.(CVE-2017-11671)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - gcc: GCC generates incorrect code for RDRAND/RDSEED     intrinsics (CVE-2017-11671)

Additional Changes :

An update for gcc is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries.

Security Fix(es) :

* gcc: GCC generates incorrect code for RDRAND/RDSEED intrinsics (CVE-2017-11671)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0849 advisory.

    - fix incorrect codegen from rdseed intrinsic use (#1482762, CVE-2017-11671)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0849 advisory.

    The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as     related support libraries.

    Security Fix(es):

    * gcc: GCC generates incorrect code for RDRAND/RDSEED intrinsics (CVE-2017-11671)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for gcc48 fixes the following issues :

Security issues fixed :

  - A new option -fstack-clash-protection is now offered,     which mitigates the stack clash type of attacks.
    [bnc#1039513] Future maintenance releases of packages     will be built with this option.

  - CVE-2017-11671: Fixed rdrand/rdseed code generation     issue [bsc#1050947]

Bugs fixed :

  - Enable LFS support in 32bit libgcov.a. [bsc#1044016]

  - Bump libffi version in libffi.pc to 3.0.11.

  - Fix libffi issue for armv7l. [bsc#988274]

  - Properly diagnose missing -fsanitize=address support on     ppc64le. [bnc#1028744]

  - Backport patch for PR65612. [bnc#1022062]

  - Fixed DR#1288. [bnc#1011348]

This update was imported from the SUSE:SLE-12:Update update project.

This update for gcc48 fixes the following issues: Security issues fixed :

  - A new option -fstack-clash-protection is now offered,     which mitigates the stack clash type of attacks.
    [bnc#1039513] Future maintenance releases of packages     will be built with this option.

  - CVE-2017-11671: Fixed rdrand/rdseed code generation     issue [bsc#1050947] Bugs fixed :

  - Enable LFS support in 32bit libgcov.a. [bsc#1044016]

  - Bump libffi version in libffi.pc to 3.0.11.

  - Fix libffi issue for armv7l. [bsc#988274]

  - Properly diagnose missing -fsanitize=address support on     ppc64le. [bnc#1028744]

  - Backport patch for PR65612. [bnc#1022062]

  - Fixed DR#1288. [bnc#1011348]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes CVE-2017-11671. Fixed bugs (http://gcc.gnu.org/PRNNNNN): 31468, 43434, 45053, 49244, 50345, 53915, 56469, 60818, 60992, 61636, 61729, 62045, 64238, 65542, 65705, 65972, 66295, 66669, 67353, 67440, 68163, 68491, 68972, 69264, 69699, 69804, 69823, 69953, 70601, 70844, 70878, 71294, 71310, 71444, 71458, 71510, 71778, 71838, 72775, 73650, 75964, 76731, 77333, 77563, 77728, 77850, 78002, 78049, 78236, 78282, 78331, 78339, 78474, 78532, 78543, 78644, 78783, 78992, 79027, 79050, 79141, 79155, 79255, 79256, 79261, 79264, 79396, 79434, 79439, 79453, 79461, 79494, 79508, 79511, 79512, 79514, 79519, 79536, 79537, 79544, 79545, 79548, 79552, 79558, 79559, 79562, 79566, 79568, 79570, 79572, 79574, 79576, 79577, 79579, 79580, 79587, 79607, 79631, 79639, 79640, 79641, 79664, 79666, 79676, 79681, 79687, 79729, 79732, 79733, 79749, 79752, 79753, 79756, 79760, 79761, 79769, 79770, 79789, 79796, 79803, 79807, 79831, 79849, 79850, 79883, 79892, 79894, 79896, 79900, 79901, 79903, 79906, 79931, 79932, 79940, 79944, 79945, 79947, 79951, 79962, 79971, 79977, 79980, 79984, 80004, 80019, 80025, 80034, 80037, 80041, 80043, 80067, 80075, 80081, 80082, 80090, 80091, 80092, 80094, 80097, 80101, 80103, 80104, 80112, 80113, 80117, 80122, 80123, 80129, 80137, 80141, 80150, 80166, 80167, 80168, 80170, 80171, 80176, 80179, 80180, 80181, 80205, 80212, 80218, 80222, 80224, 80241, 80244, 80246, 80262, 80267, 80275, 80281, 80286, 80294, 80297, 80298, 80315, 80316, 80321, 80334, 80341, 80348, 80349, 80350, 80361, 80362, 80363, 80376, 80382, 80385, 80392, 80394, 80413, 80426, 80429, 80448, 80453, 80462, 80474, 80492, 80493, 80501, 80504, 80510, 80539, 80569, 80589, 80618, 80663, 80678, 80692, 80718, 80752, 80799, 80809, 80822, 80853, 80902, 80904, 80909, 80918, 80921, 80929, 80966, 80968, 80973, 80984, 81002, 81006, 81011, 81130, 81154, 81162, 81192, 81300, 81305, 81375, 81407, 81471, 81487, 81555, 81556

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
168518	Ubuntu 16.04 ESM : GCC vulnerability (USN-5770-1)	Nessus	Ubuntu Local Security Checks	medium
127181	NewStart CGSL CORE 5.04 / MAIN 5.04 : gcc Vulnerability (NS-SA-2019-0023)	Nessus	NewStart CGSL Local Security Checks	medium
121849	Photon OS 1.0: Gcc PHSA-2018-1.0-0150	Nessus	PhotonOS Local Security Checks	medium
118419	EulerOS Virtualization 2.5.0 : gcc (EulerOS-SA-2018-1331)	Nessus	Huawei Local Security Checks	medium
110826	EulerOS 2.0 SP3 : gcc (EulerOS-SA-2018-1174)	Nessus	Huawei Local Security Checks	medium
109514	EulerOS 2.0 SP2 : gcc (EulerOS-SA-2018-1116)	Nessus	Huawei Local Security Checks	medium
109446	Scientific Linux Security Update : gcc on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	medium
109374	CentOS 7 : gcc (CESA-2018:0849)	Nessus	CentOS Local Security Checks	medium
109108	Oracle Linux 7 : gcc (ELSA-2018-0849)	Nessus	Oracle Linux Local Security Checks	medium
108988	RHEL 7 : gcc (RHSA-2018:0849)	Nessus	Red Hat Local Security Checks	medium
104245	openSUSE Security Update : gcc48 (openSUSE-2017-1223)	Nessus	SuSE Local Security Checks	medium
103355	SUSE SLED12 / SLES12 Security Update : gcc48 (SUSE-SU-2017:2526-1)	Nessus	SuSE Local Security Checks	medium
102099	Fedora 25 : gcc / gcc-python-plugin / libtool (2017-32a4a94c72)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-11671

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium