CVE-2019-15847
gcc: POWER9 "DARN" RNG intrinsic produces repeated output
Severity Score
Exploit Likelihood
Affected Versions
6Public Exploits
0Exploited in Wild
-Decision
Descriptions
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.
El backend POWER9 en GNU Compiler Collection (GCC) en versiones anteriores a la 10 podría optimizar múltiples llamadas de __builtin_darn intrínsecas en una sola llamada, reduciendo así la entropía del generador de números aleatorios. Esto ocurrió porque no se especificó una operación volátil. Por ejemplo, dentro de una sola ejecución de un programa, la salida de cada llamada __builtin_darn() puede ser la misma.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Issues addressed include code execution, cross site scripting, and denial of service vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-09-02 CVE Reserved
- 2019-09-02 CVE Published
- 2024-08-05 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-331: Insufficient Entropy
CAPEC
References (6)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|