The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example within a single execution of a program the output of every __builtin_darn() call may be the same.

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

GCC POWER9 prior to version 10 may merge builtin darn calls, lowering RNG entropy due to missing volatile.

Reporter	Title	Published	Views	Family All 75
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202123:48	–	ibm
AlpineLinux	CVE-2019-15847	2 Sep 201922:03	–	alpinelinux
CBLMariner	CVE-2019-15847 affecting package gcc 9.1.0-7	8 Oct 202018:09	–	cbl_mariner
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: cpp / gcc / gcc-c++ / gcc-gdb-plugin / gcc-gfortran / etc Multiple Vulnerabilities (ciqsa-2026_1595)	12 Oct 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : gcc (EulerOS-SA-2019-2073)	30 Sep 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.2.0 : gcc (EulerOS-SA-2019-2308)	3 Dec 201900:00	–	nessus
Tenable Nessus	GLSA-202409-22 : GCC: Flawed Code Generation	24 Sep 202400:00	–	nessus
Tenable Nessus	MiracleLinux 8 : gcc-8.3.1-5.el8 (AXSA:2020-362:02)	20 Jan 202600:00	–	nessus
Tenable Nessus	NewStart CGSL MAIN 6.06 : gcc Vulnerability (NS-SA-2025-0227)	30 Sep 202500:00	–	nessus
Tenable Nessus	NewStart CGSL MAIN 6.06 (SP) : gcc Vulnerability (NS-SA-2026-0008)	6 Mar 202600:00	–	nessus