CVE-2019-15847

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

This update for gcc7 to r275405 fixes the following issues:

Security issues fixed:

• CVE-2019-14250: Fixed an integer overflow in binutils (bsc#1142649).
• CVE-2019-15847: Fixed an optimization in the POWER9 backend of gcc that could reduce the entropy of the random number generator (bsc#1149145).

Non-security issue fixed:

• Move Live Patching technology stack from kGraft to upstream klp (bsc#1071995, fate#323487).

This update was imported from the SUSE:SLE-15:Update update project.

This update for gcc7 to r275405 fixes the following issues:

Security issues fixed:

• CVE-2019-14250: Fixed an integer overflow in binutils (bsc#1142649).
• CVE-2019-15847: Fixed an optimization in the POWER9 backend of gcc that could reduce the entropy of the random number generator (bsc#1149145).

Non-security issue fixed:

• Move Live Patching technology stack from kGraft to upstream klp (bsc#1071995, fate#323487).

This update was imported from the SUSE:SLE-15:Update update project.

This update includes the GNU Compiler Collection 9.

This update ships the GCC 9.3 release.

A full changelog is provided by the GCC team on:

https://www.gnu.org/software/gcc/gcc-9/changes.html

The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages.

To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it.

Security issues fixed:

• CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)
• CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed:

• Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254)
• Fixed miscompilation for vector shift on s390. (bsc#1141897)
• Includes a fix for Internal compiler error when building HepMC (bsc#1167898)
• Includes fix for binutils version parsing
• Add libstdc++6-pp provides and conflicts to avoid file conflicts with same minor version of libstdc++6-pp from gcc10.
• Add gcc9 autodetect -g at lto link (bsc#1149995)
• Install go tool buildid for bootstrapping go

These are all security issues fixed in the cpp7-7.5.0+r278197-10.1 package on the GA media of openSUSE Tumbleweed.

This update for gcc7 to r275405 fixes the following issues:

Security issues fixed:

• CVE-2019-14250: Fixed an integer overflow in binutils (bsc#1142649).
• CVE-2019-15847: Fixed an optimization in the POWER9 backend of gcc that could reduce the entropy of the random number generator (bsc#1149145).

Non-security issue fixed:

• Move Live Patching technology stack from kGraft to upstream klp (bsc#1071995, fate#323487).

This update includes the GNU Compiler Collection 9.

A full changelog is provided by the GCC team on:

https://www.gnu.org/software/gcc/gcc-9/changes.html

The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages.

To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it.

Security issues fixed:

• CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)
• CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed:

• Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254)
• Fixed miscompilation for vector shift on s390. (bsc#1141897)

This update for gcc9 fixes the following issues:

The GNU Compiler Collection is shipped in version 9.

A detailed changelog on what changed in GCC 9 is available at https://gcc.gnu.org/gcc-9/changes.html

The compilers have been added to the SUSE Linux Enterprise Toolchain Module.

To use these compilers, install e.g. gcc9, gcc9-c++ and build with CC=gcc-9 CXX=g++-9 set.

For SUSE Linux Enterprise base products, the libstdc++6, libgcc_s1 and other compiler libraries have been switched from their gcc8 variants to their gcc9 variants.

Security issues fixed:

• CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)
• CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed:

• Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254)
• Fixed miscompilation for vector shift on s390. (bsc#1141897)

This update for gcc7 fixes the following issues:

Security issues fixed:

• CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).
• CVE-2019-15847: Fixed POWER9 DARN miscompilation. (bsc#1149145)
• CVE-2019-14250: Includes fix for LTO linker plugin heap overflow. (bsc#1142649)

Update to GCC 7.5.0 release.

Other changes:

• Fixed KASAN kernel compile. (bsc#1205145)
• Fixed ICE with C++17 code. (bsc#1204505)
• Fixed altivec.h redefining bool in C++ which makes bool unusable (bsc#1195517):
• Adjust gnats idea of the target, fixing the build of gprbuild. [bsc#1196861]
• Do not handle exceptions in std::thread (jsc#CAR-1182)
• add -fpatchable-function-entry feature to gcc-7.
• Fixed glibc namespace violation with getauxval. (bsc#1167939)
• Backport aarch64 Straight Line Speculation mitigation [bsc#1172798, CVE-2020-13844]
• Enable fortran for the nvptx offload compiler.
• Update README.First-for.SuSE.packagers
• Avoid assembler errors with AVX512 gather and scatter instructions when using -masm=intel.
• Backport the aarch64 -moutline-atomics feature and accumulated fixes but not its default enabling. (jsc#SLE-12209, bsc#1167939)
• Fixed memcpy miscompilation on aarch64. (bsc#1178624, bsc#1178577)
• Fixed debug line info for try/catch. (bsc#1178614)
• Fixed corruption of pass private ->aux via DF. (gcc#94148)
• Fixed debug information issue with inlined functions and passed by reference arguments. [gcc#93888]
• Fixed register allocation issue with exception handling code on s390x. (bsc#1161913)
• Backport PR target/92692 to fix miscompilation of some atomic code on aarch64. (bsc#1150164)
• Fixed miscompilation in vectorized code for s390x. (bsc#1160086) [gcc#92950]
• Fixed miscompilation with thread-safe local static initialization. [gcc#85887]
• Fixed debug info created for array definitions that complete an earlier declaration. [bsc#1146475]
• Fixed vector shift miscompilation on s390. (bsc#1141897)
• Add gcc7 -flive-patching patch. [bsc#1071995, fate#323487]
• Strip -flto from $optflags.
• Disables switch jump-tables when retpolines are used. (bsc#1131264, jsc#SLE-6738)
• Fixed ICE compiling tensorflow on aarch64. (bsc#1129389)
• Fixed for aarch64 FMA steering pass use-after-free. (bsc#1128794)
• Fixed ICE compiling tensorflow. (bsc#1129389)
• Fixed s390x FP load-and-test issue. (bsc#1124644)
• Adjust gnat manual entries in the info directory. (bsc#1114592)
• Fixed to no longer try linking -lieee with -mieee-fp. (bsc#1084842)