NVD Vulnerability Detail

CVE-2019-15847

Summary	The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.
Publication Date	Sept. 3, 2019, 8:15 a.m.
Registration Date	Jan. 26, 2021, 11:39 a.m.
Last Update	Nov. 21, 2024, 1:29 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html	Mailing List Third Party Advisory
7	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481	Issue Tracking Vendor Advisory
8	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481	Issue Tracking Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-331	エントロピー不足	https://cwe.mitre.org/data/definitions/331.html

JVN Vulnerability Information

GNU Compiler Collection におけるエントロピー不足に関する脆弱性

Title	GNU Compiler Collection におけるエントロピー不足に関する脆弱性
Summary	GNU Compiler Collection (GCC) には、エントロピー不足に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 18, 2019, midnight
Registration Date	Sept. 9, 2019, 12:13 p.m.
Last Update	Sept. 9, 2019, 12:13 p.m.

Affected System

GNU Project

GNU GCC 10 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-15847	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15847
National Vulnerability Database (NVD)
2	CVE-2019-15847	https://nvd.nist.gov/vuln/detail/CVE-2019-15847

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-331	https://cwe.mitre.org/data/definitions/331.html

ベンダー情報

No	Name	URL
GCC Bugzilla
1	Bug 91481	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481

Change Log

No	Changed Details	Date of change
1	[2019年09月09日] 掲載	Sept. 9, 2019, 12:13 p.m.