How severe is CVE-2017-11671?

CVE-2017-11671 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2017-11671 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-11671?

CVE-2017-11671 primarily affects Gnu Gcc. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-11671?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-11671 published?

CVE-2017-11671 was published on 2017-07-26 and last updated on 2026-06-17.

CVE-2017-11671

CVE-2017-11671 is a medium-severity vulnerability in Gnu Gcc with a CVSS 3.x base score of 4.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-338.

Key facts

Severity: Medium (CVSS 3.x base score 4.0)
CVSS v2: 2.1
EPSS exploit prediction: 0% (36th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-338
Affected product: Gnu Gcc
Published: 2017-07-26
Last modified: 2026-06-17

Description

Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.

Frequently asked questions

What is CVE-2017-11671?: Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.
How severe is CVE-2017-11671?: CVE-2017-11671 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2017-11671 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-11671?: CVE-2017-11671 primarily affects Gnu Gcc. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-11671?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-11671 published?: CVE-2017-11671 was published on 2017-07-26 and last updated on 2026-06-17.

References

Affected products (13)

cpe:2.3:a:gnu:gcc:4.6:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:4.7:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:4.8:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:4.9:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:5.0:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:5.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:5.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:5.3:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:5.4:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:6.0:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:6.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:6.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:gcc:6.3:*:*:*:*:*:*:*

More vulnerabilities in Gnu Gcc

CVE-2018-12886 — High (CVSS 8.1): stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1…
CVE-2021-37322 — High (CVSS 7.8): GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
CVE-2002-2439 — High (CVSS 7.8): Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
CVE-2019-15847 — High (CVSS 7.5): The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the…
CVE-2008-1367 — High (CVSS 7.5): gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and…
CVE-2000-1219 — High (CVSS 7.5): The -ftrapv compiler option in gcc and g++ 3.3.3 and earlier does not handle all types of integer overflows, which may…

All CVEs affecting Gnu Gcc →

Other CWE-338 vulnerabilities

CVE-2026-56141 — Critical (CVSS 9.8): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account…
CVE-2026-3256 — Critical (CVSS 9.8): HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults…
CVE-2025-15604 — Critical (CVSS 9.8): Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions…
CVE-2025-40926 — Critical (CVSS 9.8): Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session…
CVE-2026-2439 — Critical (CVSS 9.8): Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id…
CVE-2025-15578 — Critical (CVSS 9.8): Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the…

Browse all CWE-338 vulnerabilities →