CWE-333: Improper Handling of Insufficient Entropy in TRNG
Official CWE-333 CWE context with Glexia analysis, remediation guidance, related CVEs, and ATT&CK context.
Glexia's Take
CWE-333: Improper Handling of Insufficient Entropy in TRNG
Improper Handling of Insufficient Entropy in TRNG represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Availability: DoS: Crash, Exit, or Restart: A program may crash or block if it runs out of random numbers.
Developer Pattern
CWE-333 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Confidence
high confidence from CWE-333, 4.20.
Official CWE Definition
CWE-333: Improper Handling of Insufficient Entropy in TRNG
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- This code uses a TRNG to generate a unique session id for new connections to a server: This code does not attempt to limit the number of new connections or make sure the TRNG can successfully generate a new random number. An attacker may be able to create many new connections and exhaust the entropy of the TRNG. The TRNG may then block and cause the program to crash or hang.
Remediation
- Implementation: Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.