CVE-2019-15847

High

Published: —Translated: 06/07/2026(UTC)NVD NIST

Summary

In the POWER9 backend of GCC before version 10, optimization of multiple calls to the __builtin_darn intrinsic into a single call reduces the entropy of the random number generator. This occurs because a volatile operation was not specified.

Risk Assessment

The organization may rely on less random numbers generated by code compiled with the vulnerable GCC, weakening cryptographic security and potentially facilitating attacks based on predicting random values.

Recommendation

It is recommended to upgrade GCC to version 10 or later, which includes a fix preventing incorrect optimization of __builtin_darn calls.

Other vulnerabilities in GCC

CVE-1999-1439Low
Gcc 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary .i, .s, or .o files.

Original NVD description (English source)

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single