CVE-2019-15847
High
Description
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Gnu Gcc
PublishedSep 2, 2019
First seenSep 2, 2019
How to fix
Update
- gnu gcc7.5.0, 8.4.0, 9.3.0, 10.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnu gcc | v < 7.5.0, 8.0 ≤ v < 8.4.0, 9.0 ≤ v < 9.3.0, 10.0 ≤ v < 10.1.0 | 7.5.0, 8.4.0, 9.3.0, 10.1.0 |
| opensuse leap | 15.0, 15.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.