Skip to content
Fencer Vulns
high 7.5

CVE-2019-15847 json

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a…

published 2019-09-02 7 y ago modified 2026-10-14 25 d ago also EUVD-2019-6763

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

Patch / fix

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • gcc-9 Debian 11 9.2.1-7

debian advisories DEBIAN-CVE-2019-15847

  • gcc-7 Ubuntu 18.04 LTS 7.5.0-3ubuntu1~18.04
  • gcc-8 Ubuntu 18.04 LTS 8.3.0-26ubuntu1~18.04
  • gcc-10 Ubuntu 20.04 LTS 10.2.0-5ubuntu1~20.04

ubuntu advisories UBUNTU-CVE-2019-15847

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • devtoolset-9-gcc RHEL 3 SOFTWARE_COLLECTIONS 9.3.1-2.el7
  • liblsan RHEL 3 SOFTWARE_COLLECTIONS 9.3.1-2.el7
  • libtsan RHEL 3 SOFTWARE_COLLECTIONS 9.3.1-2.el7
  • libasan5 RHEL 3 SOFTWARE_COLLECTIONS 9.3.1-2.el7
  • libubsan1 RHEL 3 SOFTWARE_COLLECTIONS 9.3.1-2.el7
  • devtoolset-9-gcc-c++ RHEL 3 SOFTWARE_COLLECTIONS 9.3.1-2.el7
  • devtoolset-9-libgccjit RHEL 3 SOFTWARE_COLLECTIONS 9.3.1-2.el7
  • devtoolset-9-gcc-gfortran RHEL 3 SOFTWARE_COLLECTIONS 9.3.1-2.el7

red hat advisories RHSA-2020:2274RHSA-2020:1864RHSA-2020:0924

  • gcc7 SLES for SAP 12 SP5, SLES 12 SP5, SLE Module for Toolchain 12 7.5.0+r278197-13.1
  • cross-nvptx-gcc7 SLE Module for Toolchain 12 7.5.0+r278197-13.1
  • gcc9 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +15 more 9.2.1+r275327-1.3.9
  • gcc9 SLE Module for Development Tools 15 SP1, SLE Module for Development Tools 15, SLE Module for Basesystem 15 SP1 +1 more 9.2.1+r275327-1.3.7
  • gcc7 SLE Module for Development Tools 15 SP1, SLE Module for Development Tools 15, SLE Module for Basesystem 15 SP1 +1 more 7.4.1+r275405-4.9.2
  • cross-nvptx-gcc7 SLE Module for Development Tools 15 SP1, SLE Module for Development Tools 15 7.4.1+r275405-4.9.2

suse advisories SUSE-SU-2023:3662-1SUSE-SU-2020:0394-1SUSE-SU-2019:3061-1SUSE-SU-2019:2702-1

  • gcc7 openSUSE Tumbleweed 7.5.0+r278197-10.1
  • gcc9 openSUSE Leap 15.1 9.3.1+git1296-lp151.2.2
  • cross-nvptx-gcc9 openSUSE Leap 15.1 9.3.1+git1296-lp151.2.1
  • gcc7 openSUSE Leap 15.0 7.4.1+r275405-lp150.12.1
  • gcc7 openSUSE Leap 15.1 7.4.1+r275405-lp151.2.6.1

opensuse advisories openSUSE-SU-2024:10703-1openSUSE-SU-2020:0716-1openSUSE-SU-2019:2365-1openSUSE-SU-2019:2364-1

  • gcc Alpine 3.11 9.3.0-r0

alpine advisories ALPINE-CVE-2019-15847

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-15847 updated cvss 7.5

gcc: POWER9 "DARN" RNG intrinsic produces repeated output

  • Red Hat CodeReady Linux Builder (v. 8) cpp-debuginfo 8.3.1-5.el8, gcc-debuginfo 8.3.1-5.el8, gcc-debugsource 8.3.1-5.el8, gcc-plugin-devel 8.3.1-5.el8, libgcc-debuginfo 8.3.1-5.el8, libitm-debuginfo 8.3.1-5.el8, +16 more Red Hat Enterprise Linux AppStream (v. 8) cpp 8.3.1-5.el8, gcc 8.3.1-5.el8, gcc-c++ 8.3.1-5.el8, gcc-gfortran 8.3.1-5.el8, gcc-gdb-plugin 8.3.1-5.el8, gcc-offload-nvptx 8.3.1-5.el8 Red Hat Enterprise Linux BaseOS (v. 8) gcc 8.3.1-5.el8, libgcc 8.3.1-5.el8, libitm 8.3.1-5.el8, libasan 8.3.1-5.el8, libgomp 8.3.1-5.el8, liblsan 8.3.1-5.el8, +7 more
    fixed: vendor fix RHSA-2020:1864
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) liblsan 8.3.1-3.2.el6, libtsan 8.3.1-3.2.el6, libasan5 8.3.1-3.2.el6, libubsan1 8.3.1-3.2.el6, devtoolset-8-gcc 8.3.1-3.2.el6, devtoolset-8-gcc-c++ 8.3.1-3.2.el6, +3 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) liblsan 9.3.1-2.el7, libtsan 9.3.1-2.el7, libasan5 9.3.1-2.el7, liblsan 8.3.1-3.2.el7, libtsan 8.3.1-3.2.el7, libubsan1 9.3.1-2.el7, +12 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) liblsan 8.3.1-3.2.el7, libtsan 8.3.1-3.2.el7, libasan5 8.3.1-3.2.el7, libubsan1 8.3.1-3.2.el7, devtoolset-8-gcc 8.3.1-3.2.el7, devtoolset-8-gcc-c++ 8.3.1-3.2.el7, +3 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) liblsan 9.3.1-2.el7, libtsan 9.3.1-2.el7, libasan5 9.3.1-2.el7, liblsan 8.3.1-3.2.el7, libtsan 8.3.1-3.2.el7, libubsan1 9.3.1-2.el7, +12 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) liblsan 9.3.1-2.el7, libtsan 9.3.1-2.el7, libasan5 9.3.1-2.el7, liblsan 8.3.1-3.2.el7, libtsan 8.3.1-3.2.el7, libubsan1 9.3.1-2.el7, +12 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) liblsan 8.3.1-3.2.el6, libtsan 8.3.1-3.2.el6, libasan5 8.3.1-3.2.el6, libubsan1 8.3.1-3.2.el6, devtoolset-8-gcc 8.3.1-3.2.el6, devtoolset-8-gcc-c++ 8.3.1-3.2.el6, +3 more
    +1 more products
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) liblsan 9.3.1-2.el7, libtsan 9.3.1-2.el7, libasan5 9.3.1-2.el7, liblsan 8.3.1-3.2.el7, libtsan 8.3.1-3.2.el7, libubsan1 9.3.1-2.el7, +12 more
    fixed: vendor fix RHSA-2020:0924
  • Red Hat Enterprise Linux 5 gcc Red Hat Enterprise Linux 6 cpp, gcc, libgcc, libgcj, libitm, gcc-c++, +14 more Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, libgcc, libitm, +15 more Red Hat Enterprise Linux 8 mingw32-cpp, mingw32-gcc, mingw64-cpp, mingw64-gcc, mingw32-gcc-c++, mingw64-gcc-c++
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 7.5

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

3.18% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.