Improper Handling of Insufficient Entropy in TRNG
CWE-333
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
We track 1 vulnerability of this type. 100% are rated high or critical, and the average CVSS score is 7.2.
How this weakness is prevented
- Implementation: Since the rate at which true random numbers can be generated is limited, it is important that one uses them only when they are needed for security.
- Implementation: Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.
Latest Improper Handling of Insufficient Entropy in TRNG vulnerabilities
- 7.2 High severity
AMD Ryzen™ 9000HX Series Processors: Improper Handling of Insufficient Entropy in TRNG
Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values.