Your submission was sent successfully! Close

CVE-2019-15847

Published: 2 September 2019

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

Priority

Negligible

CVSS 3 base score: 7.5

Status

Package Release Status
gcc-3.3
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Not vulnerable
(predates power9)
xenial Not vulnerable
(predates power9)
bionic Not vulnerable
(predates power9)
disco Not vulnerable
(predates power9)
eoan Not vulnerable
(predates power9)
focal Not vulnerable
(predates power9)
impish Not vulnerable
(predates power9)
groovy Not vulnerable
(predates power9)
hirsute Not vulnerable
(predates power9)
jammy Not vulnerable
(predates power9)
gcc-4.4
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.6
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Not vulnerable
(predates power9)
trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.7
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Not vulnerable
(predates power9)
xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.8
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Not vulnerable
(predates power9)
xenial Not vulnerable
(predates power9)
bionic Not vulnerable
(predates power9)
disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.9
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-5
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Not vulnerable
(predates power9)
disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-6
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Not vulnerable
(predates power9)
disco Not vulnerable
(predates power9)
eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-7
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Does not exist

hirsute Ignored
(reached end-of-life)
jammy Does not exist

gcc-8
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
jammy Does not exist

gcc-9
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Ignored
(reached end-of-life)
eoan Not vulnerable
(9.2.1-9ubuntu2)
focal Not vulnerable
(9.2.1-28ubuntu1)
impish Not vulnerable
(9.2.1-28ubuntu1)
groovy Not vulnerable
(9.2.1-28ubuntu1)
hirsute Not vulnerable
(9.2.1-28ubuntu1)
jammy Not vulnerable
(9.2.1-28ubuntu1)
gcc-5-cross
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Not vulnerable
(predates power9)
disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-6-cross
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Not vulnerable
(predates power9)
disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-6-cross-ports
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Not vulnerable
(predates power9)
disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-7-cross
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-7-cross-ports
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-8-cross
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Does not exist

hirsute Ignored
(reached end-of-life)
jammy Does not exist

gcc-8-cross-ports
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Does not exist

hirsute Ignored
(reached end-of-life)
jammy Does not exist

gcc-9-cross
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
jammy Needs triage

gcc-9-cross-ports
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
jammy Needs triage

gcc-snapshot
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needs-triage)
jammy Needs triage

gcc-i686-linux-android
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

xenial Ignored
(end of standard support, was needs-triage)
jammy Does not exist

gcc-4.7-armel-cross
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.7-armhf-cross
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.8-arm64-cross
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.8-armhf-cross
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.8-powerpc-cross
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-4.8-ppc64el-cross
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-arm-linux-androideabi
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

xenial Ignored
(end of standard support, was needs-triage)
jammy Does not exist

gcc-arm-none-eabi
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needs-triage)
jammy Needs triage

gcc-avr
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needs-triage)
jammy Needs triage

gcc-defaults
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Ignored
(end of ESM support, was needs-triage)
trusty Needs triage

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
jammy Needs triage

xenial Needs triage

gcc-defaults-arm64-cross
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-defaults-armel-cross
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-defaults-armhf-cross
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-defaults-powerpc-cross
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-defaults-ppc64el-cross
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gcc-h8300-hms
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needs-triage)
jammy Needs triage

gcc-m68hc1x
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needs-triage)
jammy Needs triage

gcc-mingw-w64
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Needs triage

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needs-triage)
jammy Needs triage

gcc-msp430
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needs-triage)
jammy Needs triage

gcc-opt
Launchpad, Ubuntu, Debian
upstream Needs triage

precise Does not exist

trusty Does not exist

bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
impish Needs triage

hirsute Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needs-triage)
jammy Needs triage

gccgo-4.9
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Not vulnerable
(predates power9)
xenial Does not exist

bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

gccgo-6
Launchpad, Ubuntu, Debian
upstream Not vulnerable
(predates power9)
precise Does not exist

trusty Does not exist

xenial Not vulnerable
(predates power9)
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

impish Does not exist

groovy Does not exist

hirsute Does not exist

jammy Does not exist

Notes

AuthorNote
mdeslaur
this is part of the power9 ISA, and Ubuntu binaries are built
with the power8 ISA, so no binaries in the archive are affected

setting priority to negligible

References

Bugs