Note:
This project will be discontinued after December 13, 2021. [more]
2019-09-02
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.
| Products | Gcc |
| Type | Insufficient Entropy (CWE-331) |
| First patch | - None (likely due to unavailable code) |
| Links |
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html • https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481 |