The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing t…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Sep 2, 2019 · NIST NVD

   Detected

   The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

2. Oct 14, 2026 · NIST NVD

   Updated

   The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

Affected

• cpe gnu/gccversion unspecified
• cpe opensuse/leap15.0
• cpe opensuse/leap15.1

Sources

• CVE.orgVulnerability recordCVE-2019-15847

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2019-15847

  30-day exploitation probability 3.2%

  first.org
• NIST NVDVulnerability recordCVE-2019-15847

  The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For exam

  nvd.nist.gov

References

• Mailing List · lists.opensuse.org
• Mailing List · lists.opensuse.org
• Mailing List · lists.opensuse.org
• Issue Tracking · gcc.gnu.org