Skip to content
OpenAdvisories

Weakness (CWE)

CWE-342: Predictable Exact Value from Previous Values

Base Draft

An exact value or random number can be precisely predicted by observing previous values.

How to prevent it (3 mitigations)

  1. Increase the entropy used to seed a PRNG.

  2. Architecture and Design, Requirements

    Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

  3. Implementation

    Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

Source: MITRE CWE-342

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed