Open Source Development

Power Open Source Development

Explore the open source tools and capabilities for building and deploying modern applications on IBM Power platforms including AIX, IBM i, and Linux.


#Power


#Power

 View Only
Back to discussions
Expand all | Collapse all

vulnerability CVE-2019-15847 and gcc 8.3 AIX7.1

  • 1.  vulnerability CVE-2019-15847 and gcc 8.3 AIX7.1

    Posted Mon December 19, 2022 12:15 PM
    I already asked this on AIX group, however it seems that most of the questions regarding CVEs are discussed here. So I'm re-posting my question in this group.

    According to NVD, this vulnerability affects gcc in version 8.3.0.
    The gcc installed on the AIX machine is taken from ( https://public.dhe.ibm.com/aix/freeSoftware/aixtoolbox/RPMS/ppc-7.1/gcc8/gcc8-cplusplus-8.3.0-6.aix7.1.ppc.rpm ).
    I tried to test if this version is affected using code provided in https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481, but it seems that this gcc version does not contain POWER9 function __builtin_darn().

    >bash-5.1# gcc-8 -maix64 darn.c -o darn
    darn.c: In function 'main':
    darn.c:8:21: warning: implicit declaration of function '__builtin_darn'; did you mean '__builtin_nan'? [-Wimplicit-function-declaration]
    darn[i] = __builtin_darn(); // or __builtin_darn_raw()
    ^~~~~~~~~~~~~~
    __builtin_nan
    ld: 0711-317 ERROR: Undefined symbol: .__builtin_darn

    I have the same result when compiling 32bit version.

    Can anyone confirm/deny that gcc 8.3.0-6 build for AIX is not vulnerable to this CVE?

    ------------------------------
    Lukasz Kowalczyk
    ------------------------------

    #AIXOpenSource


  • 2.  RE: vulnerability CVE-2019-15847 and gcc 8.3 AIX7.1

    Posted Tue December 20, 2022 08:28 AM
    Hi Lukasz,

    I don't see this builtin is being part of gcc-8.3.0.
    So, this is not affecting the gcc 8.3.0-6 build for AIX.

    $ /opt/freeware/bin/gcc-8 -maix64 darn.c -o darn -mcpu=power9
    cc1: warning: will not generate 'power9' instructions because assembler lacks 'power9' support
    darn.c: In function 'main':
    darn.c:8:15: warning: implicit declaration of function '__builtin_darn'; did you mean '__builtin_nan'? [-Wimplicit-function-declaration]
    darn[i] = __builtin_darn(); // or __builtin_darn_raw()
    ^~~~~~~~~~~~~~
    __builtin_nan
    ld: 0711-317 ERROR: Undefined symbol: .__builtin_darn
    ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more information.
    collect2: error: ld returned 8 exit status

    $ /opt/freeware/bin/gcc-10 -maix64 darn.c -o darn -mcpu=power9
    $

    ------------------------------
    SANGAMESH
    ------------------------------

    Original Message


Related Content