CVE-2019-15847CWE-331

CVE-2019-15847

High · published September 3, 2019

CVSS v3.1
7.5
EPSS
3%
Percentile
88.0
In the wild
Unconfirmed
What it is

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03181 · 88.0th percentile
Weakness
CWE-331 · Insufficient Entropy
Published
2019-09-03T03:15Z
Affected products (6)
ProductVersionsFixed in
gnu/gcc< 7.5.07.5.0
gnu/gcc≥ 8.0, < 8.4.08.4.0
gnu/gcc≥ 9.0, < 9.3.09.3.0
gnu/gcc≥ 10.0, < 10.1.010.1.0
opensuse/leapall versions—
opensuse/leapall versions—
References (9)
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html · [email protected]https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481 · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html · af854a3a-2127-422b-91ae-364da2661108https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 02 SEP 22:03Z
    The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus…
    cvelistv5