The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1864 advisory.

  - The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the
    __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator.
    This occurred because a volatile operation was not specified. For example, within a single execution of a     program, the output of every __builtin_darn() call may be the same. (CVE-2019-15847)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0924 advisory.

  - gcc: POWER9 DARN RNG intrinsic produces repeated output (CVE-2019-15847)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2274 advisory.

  - gcc: POWER9 DARN RNG intrinsic produces repeated output (CVE-2019-15847)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update includes the GNU Compiler Collection 9.

This update ships the GCC 9.3 release.

A full changelog is provided by the GCC team on :

https://www.gnu.org/software/gcc/gcc-9/changes.html

The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages.

To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it.

Security issues fixed :

  - CVE-2019-15847: Fixed a miscompilation in the POWER9     back end, that optimized multiple calls of the
    __builtin_darn intrinsic into a single call.
    (bsc#1149145)

  - CVE-2019-14250: Fixed a heap overflow in the LTO linker.
    (bsc#1142649)

Non-security issues fixed :

  - Split out libstdc++ pretty-printers into a separate     package supplementing gdb and the installed runtime.
    (bsc#1135254)

  - Fixed miscompilation for vector shift on s390.
    (bsc#1141897)

  - Includes a fix for Internal compiler error when building     HepMC (bsc#1167898)

  - Includes fix for binutils version parsing

  - Add libstdc++6-pp provides and conflicts to avoid file     conflicts with same minor version of libstdc++6-pp from     gcc10.

  - Add gcc9 autodetect -g at lto link (bsc#1149995)

  - Install go tool buildid for bootstrapping go

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1864 advisory.

  - gcc: POWER9 DARN RNG intrinsic produces repeated output (CVE-2019-15847)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for gcc9 fixes the following issues :

The GNU Compiler Collection is shipped in version 9.

A detailed changelog on what changed in GCC 9 is available at https://gcc.gnu.org/gcc-9/changes.html

The compilers have been added to the SUSE Linux Enterprise Toolchain Module.

To use these compilers, install e.g. gcc9, gcc9-c++ and build with CC=gcc-9 CXX=g++-9 set.

For SUSE Linux Enterprise base products, the libstdc++6, libgcc_s1 and other compiler libraries have been switched from their gcc8 variants to their gcc9 variants.

Security issues fixed :

CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)

CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed: Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime.
(bsc#1135254)

Fixed miscompilation for vector shift on s390. (bsc#1141897)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gcc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - This is compiler for arm64. Security Fix(es):The POWER9     backend in GNU Compiler Collection (GCC) before version     10 could optimize multiple calls of the __builtin_darn     intrinsic into a single call, thus reducing the entropy     of the random number generator. This occurred because a     volatile operation was not specified. For example,     within a single execution of a program, the output of     every __builtin_darn() call may be the     same.(CVE-2019-15847)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes the GNU Compiler Collection 9.

A full changelog is provided by the GCC team on :

https://www.gnu.org/software/gcc/gcc-9/changes.html

The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages.

To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it.

Security issues fixed :

CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)

CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed: Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime.
(bsc#1135254)

Fixed miscompilation for vector shift on s390. (bsc#1141897)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gcc7 to r275405 fixes the following issues :

Security issues fixed :

  - CVE-2019-14250: Fixed an integer overflow in binutils     (bsc#1142649).

  - CVE-2019-15847: Fixed an optimization in the POWER9     backend of gcc that could reduce the entropy of the     random number generator (bsc#1149145).

Non-security issue fixed :

  - Move Live Patching technology stack from kGraft to     upstream klp (bsc#1071995, fate#323487).

This update was imported from the SUSE:SLE-15:Update update project.

This update for gcc7 to r275405 fixes the following issues :

Security issues fixed :

CVE-2019-14250: Fixed an integer overflow in binutils (bsc#1142649).

CVE-2019-15847: Fixed an optimization in the POWER9 backend of gcc that could reduce the entropy of the random number generator (bsc#1149145).

Non-security issue fixed: Move Live Patching technology stack from kGraft to upstream klp (bsc#1071995, fate#323487).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The POWER9 backend in GNU Compiler Collection (GCC)     before version 10 could optimize multiple calls of the
    __builtin_darn intrinsic into a single call, thus     reducing the entropy of the random number generator.
    This occurred because a volatile operation was not     specified. For example, within a single execution of a     program, the output of every __builtin_darn() call may     be the same.(CVE-2019-15847)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180909	Oracle Linux 8 : gcc (ELSA-2020-1864)	Nessus	Oracle Linux Local Security Checks	high
170353	RHEL 6 / 7 : devtoolset-8-gcc (RHSA-2020:0924)	Nessus	Red Hat Local Security Checks	high
170330	RHEL 7 : devtoolset-9-gcc (RHSA-2020:2274)	Nessus	Red Hat Local Security Checks	high
136959	openSUSE Security Update : gcc9 (openSUSE-2020-716)	Nessus	SuSE Local Security Checks	high
136055	RHEL 8 : gcc (RHSA-2020:1864)	Nessus	Red Hat Local Security Checks	high
133791	SUSE SLES12 Security Update : gcc9 (SUSE-SU-2020:0394-1)	Nessus	SuSE Local Security Checks	high
131473	EulerOS Virtualization for ARM 64 3.0.2.0 : gcc (EulerOS-SA-2019-2308)	Nessus	Huawei Local Security Checks	high
131311	SUSE SLED15 / SLES15 Security Update : gcc9 (SUSE-SU-2019:3061-1)	Nessus	SuSE Local Security Checks	high
130160	openSUSE Security Update : gcc7 (openSUSE-2019-2365)	Nessus	SuSE Local Security Checks	high
130159	openSUSE Security Update : gcc7 (openSUSE-2019-2364)	Nessus	SuSE Local Security Checks	high
130002	SUSE SLED15 / SLES15 Security Update : gcc7 (SUSE-SU-2019:2702-1)	Nessus	SuSE Local Security Checks	high
129432	EulerOS 2.0 SP8 : gcc (EulerOS-SA-2019-2073)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2019-15847

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high