Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 27 Jul 2017 09:40:09 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: CVE-2017-11671: GCC generates incorrect code for RDRAND/RDSEED intrinsics

Earlier this year, a GCC bug was fixed which could lead to intrinsics
for RDRAND and (more likely) RDSEED to produce non-random results.
These instructions use the carry flag to report success or failure,
and GCC used to generate instruction sequences which clobbered the
flag before applications had a change to read it:

  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180
  https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.html

Practical impact is hopefully limited because the intrinsics are
difficult to use due to an unrelated GCC usability issue, and inline
assembly is not impacted by this issue.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ