Skip to content
OpenAdvisories

Weakness (CWE)

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)

Variant Draft

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

How to prevent it (3 mitigations)

  1. Use non-predictable inputs for seed generation.

  2. Architecture and Design, Requirements

    Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems, or use the more recent FIPS 140-3 [REF-1192] if possible.

  3. Implementation

    Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

Source: MITRE CWE-337

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed