CVE-2019-15847 affects GNU Compiler Collection (GCC) versions prior to 10, specifically its POWER9 backend, where multiple calls to the __builtin_darn intrinsic could be optimized into a single call, leading to reduced random number generator entropy. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-exploitable flaw with low attack complexity that could result in high confidentiality impact by making random numbers predictable. While no active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB) has been identified, there is some community discussion and media coverage, suggesting awareness of the issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.5.0CPE matchmatch criteria | cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:*:* | ||
>= 8.0, < 8.4.0CPE matchmatch criteria | cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:*:* | ||
>= 9.0, < 9.3.0CPE matchmatch criteria | cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:*:* | ||
>= 10.0, < 10.1.0CPE matchmatch criteria | cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:*:* | ||
15.0CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2019-15847
Aug 11, 2020The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example within a single execution of a program the output of every __builtin_darn() call may be the same.
Sep 10, 2019gcc: POWER9 "DARN" RNG intrinsic produces repeated output
Sep 2, 2019