831
public int generateAccountID() {
Random random = new Random(SEED);
return random.nextInt();
}
Because the program uses the same seed value for every invocation of the PRNG, its values are
predictable, making the system vulnerable to attack.
Example 2:
Both of these examples use a statistical PRNG seeded with the current value of the system clock to
generate a random number:
Example Language: Java (Bad)
Random random = new Random(System.currentTimeMillis());
int accountID = random.nextInt();
Example Language: C (Bad)
srand(time());
int randNum = rand();
An attacker can easily predict the seed used by these PRNGs, and so also predict the stream of
random numbers generated. Note these examples also exhibit CWE-338 (Use of Cryptographically
Weak PRNG).
Example 3:
This code grabs some random bytes and uses them for a seed in a PRNG, in order to generate a
new cryptographic key.
Example Language: Python (Bad)
# getting 2 bytes of randomness for the seeding the PRNG
seed = os.urandom(2)
random.seed(a=seed)
key = random.getrandbits(128)
Since only 2 bytes are used as a seed, an attacker will only need to guess 2^16 (65,536) values
before being able to replicate the state of the PRNG.
Observed Examples
Reference Description
CVE-2020-7010 Cloud application on Kubernetes generates passwords using a weak random
number generator based on deployment time.
https://www.cve.org/CVERecord?id=CVE-2020-7010
CVE-2019-11495 server uses erlang:now() to seed the PRNG, which results in a small search
space for potential random seeds
https://www.cve.org/CVERecord?id=CVE-2019-11495
CVE-2018-12520 Product's PRNG is not seeded for the generation of session IDs
https://www.cve.org/CVERecord?id=CVE-2018-12520
CVE-2016-10180 Router's PIN generation is based on rand(time(0)) seeding.
https://www.cve.org/CVERecord?id=CVE-2016-10180
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)