{"id":"CVE-2019-15847","title":"The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator","summary":"The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a vol…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-331"],"vendor":"gnu","product":"gcc","affected":["gcc < 7.5.0","gcc >= 8.0, < 8.4.0","gcc >= 9.0, < 9.3.0","gcc >= 10.0, < 10.1.0","leap = 15.0","leap = 15.1"],"patched":["gcc 10.1.0"],"published":"2019-09-02","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:46.907","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-15847","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html","label":"cve@mitre.org"},{"url":"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-15847.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-15847"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1755523"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15847"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15847"},{"url":"https://access.redhat.com/errata/RHSA-2020:0924"},{"url":"https://access.redhat.com/errata/RHSA-2020:2274"},{"url":"https://access.redhat.com/errata/RHSA-2020:1864"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.03181,"epssPercentile":0.87752,"ingestedAt":"2026-10-14T07:21:04.817Z","slug":"CVE-2019-15847","body":"## Overview\n\nThe POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.\n\n## Affected\n\n- `gcc < 7.5.0`\n- `gcc >= 8.0, < 8.4.0`\n- `gcc >= 9.0, < 9.3.0`\n- `gcc >= 10.0, < 10.1.0`\n- `leap = 15.0`\n- `leap = 15.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gcc 10.1.0`\n\n## Vendor advisories\n\n- **RHSA-2020:0924** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6), Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7), … · released 2020-03-23 · [advisory](https://access.redhat.com/errata/RHSA-2020:0924)\n- **RHSA-2020:2274** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) · released 2020-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2020:2274)\n- **RHSA-2020:1864** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8), Red Hat CodeReady Linux Builder (v. 8) · released 2020-04-28 · [advisory](https://access.redhat.com/errata/RHSA-2020:1864)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.6,"exploitation":0,"ransomware":0},"changes":[]}