CWE-335, Incorrect Usage of Seeds in Pseudo-Random Number Generator, applies when a product uses a PRNG but does not manage its seeds correctly. It is the umbrella for the same seed, predictable seed and small seed space weaknesses that follow it.
Anyone who instantiates a generator themselves, or relies on a library that does, can get this wrong.
How it happens
MITRE explains that PRNGs are deterministic. Their output appears random, but they cannot create entropy. They rely on cryptographically secure and unique seeds, so proper seeding is critical. Seed management has two sides: protecting seeds as cryptographic material, like a key, and whenever possible using a uniquely generated seed from a cryptographically secure source.
Common mistakes are seeding with the same value on every start, seeding from the clock or process ID, and never seeding at all. The observed examples:
- CVE-2020-7010: a Kubernetes cloud application generated passwords with a weak generator based on deployment time.
- CVE-2019-11495: a server used erlang:now() to seed the generator, leaving a small search space of seeds.
- CVE-2018-12520: a product's generator was not seeded when generating session IDs.
# Vulnerable: seed derived from the clock
random.seed(int(time.time()))
token = random.getrandbits(64)
What an attacker gains
If a generator is used incorrectly, such as using the same seed on each initialization or using a predictable seed, an attacker can bypass protection mechanisms that depend on its output.
How to find it
Static analysis can flag explicit seeding calls with constants or time values. In review, check every place a generator is constructed and where its seed comes from.
How to fix it
- Do not seed security generators yourself. Use the operating system secure source, which seeds and re-seeds itself.
- If you must seed, use unpredictable, high entropy input.
- Treat seeds as secrets, protected like keys.
- Never reuse a seed across restarts or instances.
token = secrets.token_bytes(8)
Quick check
Why is time a bad seed?
An attacker often knows roughly when a value was made, so the search space shrinks to a few thousand guesses.
