CWE-332—Insufficient Entropy in PRNG
PUBLISHEDweakness recordMedium
released 2006-07-19 · last modified 2025-12-11
Metadata
- CWE ID：
- CWE-332
- 摘要：
- Variant
- 结构：
- Simple
- 状态：
- Draft
- 发布日期：
- 2006-07-19
- 更新日期：
- 2025-12-11
名称
Insufficient Entropy in PRNG
描述
The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
常见后果
- 范围：
- Availability
- 影响：
- DoS: Crash, Exit, or Restart
- 注释：
- If a pseudo-random number generator is using a limited entropy source which runs out (if the generator fails closed), the program may pause or crash.
- 范围：
- Access Control, Other
- 影响：
- Bypass Protection Mechanism, Other
- 注释：
- If a PRNG is using a limited entropy source which runs out, and the generator fails open, the generator could produce predictable random numbers. Potentially a weak source of random numbers could weaken the encryption method used for authentication of users.