CWE-332, Insufficient Entropy in PRNG, is about a pseudo-random number generator that lacks entropy, or is given too little. MITRE frames it as both a stability and a security threat.
Systems that start up with little entropy are prone to it: embedded devices, fresh virtual machines and containers, and code that generates keys at boot.
How it happens
A generator depends on an entropy source. If that source is limited and runs out, the generator may stall, may fail, or may carry on producing weak output without telling anyone.
Two observed examples show the second path. A JavaScript based cryptocurrency library could fall back to the insecure Math.random() function instead of reporting the failure (cited in the MITRE record as a chain). CVE-2019-1715 is a security product with insufficient entropy in its deterministic random bit generator, allowing collisions and private key discovery.
// Vulnerable pattern: silent fallback to a weak source
function rnd() {
try { return secureRandom(); }
catch (e) { return Math.random(); }
}
What an attacker gains
Two effects are listed. Availability: if a generator uses a limited source that runs out, the product can crash, exit or restart. Access control: if the generator fails open into weak output, an attacker can bypass protections that rely on it.
How to find it
Static analysis can find some patterns, including fallbacks to weak generators. Test startup behavior on a clean machine or container image, since entropy is often lowest right after boot.
How to fix it
- Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems, and consult its approved generator list.
- Consider a generator that re-seeds itself from high quality output, such as hardware devices.
- When choosing a generator, look at its entropy sources. Depending on your needs, pick one that always uses strong data, or one that fails in a weak but predictable way, or that gives a middle ground of protection through techniques such as re-seeding. MITRE notes that something always providing a predictable amount of strength is generally preferable.
- Never fall back silently to a weaker generator. Fail loudly instead.
Quick check
Should a failed secure generator fall back to a normal one?
No. A silent fallback is exactly what the cryptocurrency library case shows. Report the error.
