---
id: CVE-2019-15847
title: >-
  The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could
  optimize multiple calls of the __builtin_darn intrinsic into a single call,
  thus reducing the entropy of the random number generator
summary: >-
  The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could
  optimize multiple calls of the __builtin_darn intrinsic into a single call,
  thus reducing the entropy of the random number generator. This occurred
  because a vol…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-331
vendor: gnu
product: gcc
affected:
  - gcc < 7.5.0
  - 'gcc >= 8.0, < 8.4.0'
  - 'gcc >= 9.0, < 9.3.0'
  - 'gcc >= 10.0, < 10.1.0'
  - leap = 15.0
  - leap = 15.1
patched:
  - gcc 10.1.0
published: '2019-09-02'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:46.907'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-15847'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html'
    label: cve@mitre.org
  - url: 'https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-15847.json
  - url: 'https://access.redhat.com/security/cve/CVE-2019-15847'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1755523'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2019-15847'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-15847'
  - url: 'https://access.redhat.com/errata/RHSA-2020:0924'
  - url: 'https://access.redhat.com/errata/RHSA-2020:2274'
  - url: 'https://access.redhat.com/errata/RHSA-2020:1864'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.03181
epssPercentile: 0.87752
ingestedAt: '2026-10-14T07:21:04.817Z'
---

## Overview

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

## Affected

- `gcc < 7.5.0`
- `gcc >= 8.0, < 8.4.0`
- `gcc >= 9.0, < 9.3.0`
- `gcc >= 10.0, < 10.1.0`
- `leap = 15.0`
- `leap = 15.1`

## Remediation

Upgrade past the affected range:

- `gcc 10.1.0`

## Vendor advisories

- **RHSA-2020:0924** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6), Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7), … · released 2020-03-23 · [advisory](https://access.redhat.com/errata/RHSA-2020:0924)
- **RHSA-2020:2274** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) · released 2020-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2020:2274)
- **RHSA-2020:1864** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8), Red Hat CodeReady Linux Builder (v. 8) · released 2020-04-28 · [advisory](https://access.redhat.com/errata/RHSA-2020:1864)