CWE-337

Predictable Seed in Pseudo-Random Number Generator (PRNG). [Protection-Mechanism-Failure]

Required inputs: IR

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time. The use of predictable seeds significantly reduces the number of possible seeds that an attacker would need to test in order to predict which random numbers will be generated by the PRNG.

Demonstrative Examples

Example 1

Both of these examples use a statistical PRNG seeded with the current value of the system clock to generate a random number:

Example Language:Java (Unsupported language for documentation only)
    Random random = new Random(System.currentTimeMillis());
    int accountID = random.nextInt();

Example Language:C
    srand(time());
    int randNum = rand();

An attacker can easily predict the seed used by these PRNGs, and so also predict the stream of random numbers generated. Note these examples also exhibit CWE-338 (Use of Cryptographically Weak PRNG).

Excerpts from CWE [https://cwe.mitre.org], Copyright (C) 2006-2026, the MITRE Corporation. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key	Text	Severity	Disabled
predictable_seed	A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.	None	False

Options

• This rule shares the following common options: exclude_in_macros, exclude_messages_in_system_headers, excludes, extend_exclude_to_macro_invocations, includes, justification_checker, languages, post_processing, provider, report_at, severity

• The following places define options that affect this rule: Stylechecks, Analysis-GlobalOptions

prngs

prngs : set[bauhaus.analysis.config.QualifiedName] = {'srand', 'std::srand'}

Qualified names of calls to random number generators.

 

routines_returning_predictable_values

routines_returning_predictable_values : set[bauhaus.analysis.config.QualifiedName] = {'getpid', 'time'}

Routines that should be considered as returning a predictable seed.

 

whitelist

whitelist : set[bauhaus.analysis.config.QualifiedName] | None = None

List of reliable (non-predictable) sources for seeds. If set, only calls on the list are allowed to provide seeds.