CWE-342: Predictable Exact Value from Previous Values

MITRE CWE weakness

Description

An exact value or random number can be precisely predicted by observing previous values.

Common consequences

• Other: Varies by Context

Mitigations

General — Increase the entropy used to seed a PRNG.

Architecture and Design — Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

Implementation — Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

References

• CWE page: https://cwe.mitre.org/data/definitions/342.html
• CWE list: https://cwe.mitre.org/data/index.html