BaseDraftCWE-342

CWE-342: Predictable Exact Value from Previous Values

Description

An exact value or random number can be precisely predicted by observing previous values.

Abstraction: BaseA weakness specific enough to point to detection and prevention methods.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

Other
Varies by Context

Potential mitigations

Increase the entropy used to seed a PRNG.
Architecture and DesignRequirementsLibraries or Frameworks
Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (Approved Random Number Generators).
Implementation
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

Related weaknesses

Parent weaknesses

CWE-340Generation of Predictable Numbers or Identifiers

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Potential mitigations

Increase the entropy used to seed a PRNG.

Architecture and DesignRequirementsLibraries or Frameworks

Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (Approved Random Number Generators).

Implementation

Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.