Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Gnu Compiler Collection - CVE-2019-15847

Vulnerability identifier: #VU28259

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15847

CWE-ID: CWE-338

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to the POWER9 backend in GNU Compiler Collection (GCC) can optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This vulnerability may weaken security features that rely on random number generator.

Gnu Compiler Collection
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Opensuse
devtoolset-9-gcc (Red Hat package)
devtoolset-8-gcc (Red Hat package)
gcc (Red Hat package)
sys-devel/gcc

Install updates from vendor's website.

Gnu Compiler Collection - addressed in versions 8.4.0, 9.3.0
devtoolset-9-gcc (Red Hat package) - update to 9.3.1-2.el7
devtoolset-8-gcc (Red Hat package) - addressed in versions 8.3.1-3.2.el6, 8.3.1-3.2.el7
gcc (Red Hat package) - update to 8.3.1-5.el8
sys-devel/gcc - update to 10.0

• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html
• https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481
• https://gcc.gnu.org/git/?p=gcc.git&a=commit;h=e99bfdd2a8db732ea84cf0a6486707e5e821ad7e

• Insufficient randomization in GCC for Power9
• OpenSUSE Linux update for gcc9
• Red Hat Software Collections update for devtoolset-9-gcc
• OpenSUSE Linux update for gcc7
• OpenSUSE Linux update for gcc7
• Red Hat Developer Toolset 8 for Red Hat Enterprise Linux update for devtoolset-8-gcc
• Red Hat Enterprise Linux 8 update for gcc
• Gentoo update for GCC