Use of Predictable Algorithm in Random Number Generator
CWE-1241
The device uses an algorithm that is predictable and generates a pseudo-random number.
Pseudo-random number generator algorithms are predictable because their registers have a finite number of possible states, which eventually lead to repeating patterns. As a result, pseudo-random number generators (PRNGs) can compromise their randomness or expose their internal state to various attacks, such as reverse engineering or tampering.
We track 2 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.3.
How this weakness is prevented
- Architecture and Design Implementation: It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.
Latest Use of Predictable Algorithm in Random Number Generator vulnerabilities
- 7.1 High severity
MicroRealEstate: Authorization Bypass Through User-Controlled Key
Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1
- 7.5 High severity
coredns: Predictable Seed in Pseudo-Random Number Generator (PRNG)
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems