CWE-341 — Predictable from Observable State
CWE-341: Predictable from Observable State
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | — |
Description
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
Common consequences
- Other: Varies by Context
Mitigations
Implementation — Increase the entropy used to seed a PRNG.
Architecture and Design — Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Implementation — Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.
References
- CWE page: https://cwe.mitre.org/data/definitions/341.html
- CWE list: https://cwe.mitre.org/data/index.html