...
| Code Block |
|---|
1st run: -1597837311, 906130682, -1308031886, 1048837407, -931041900, -658114613, -1709220953, -1019697289, 1802206541,
406505841,
2nd run: 885904119, -687379556, -1782296854, 1443701916, -624291047, 2049692692, -990451563, -142307804, 1257079211,
897185104,
3rd run: 190598304, -1537409464, 1594174739, -424401916, -1975153474, 826912927, 1705549595, -1515331215, 474951399,
1982500583, |
Risk Assessment
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MSC32-C | Medium | Likely | Low | P18 | L1 |
Automated Detection
Tool | Version | Checker | Description | ||||
|---|---|---|---|---|---|---|---|
| Astrée |
|
| Supported, but no explicit checker | |||||||||
| Polyspace Bug Finder | R2016a | Deterministic random output from constant seed, Predictable random output from predictable seed | Seeding routine uses a constant seed making the output deterministic Seeding routine uses a predictable seed making the output predictable | ||||||
| Parasoft C/C++test |
| SECURITY-02, SECURITY-02_b, SECURITY-28, BD-SECURITY-RAND | Implemented | ||||||
| PRQA QA-C | 9.1 | 5031 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C Secure Coding Standard | MSC30-C. Do not use the rand() function for generating pseudorandom numbers | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C | MSC51-CPP. Ensure your random number generator is properly seeded | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CWE 2.11 | CWE-327, Use of a Broken or Risky Cryptographic Algorithm | 2017-05-16: CERT: Rule subset of CWE |
| CWE 2.11 | CWE-330, Use of Insufficiently Random Values | 2017-06-28: CERT: Rule subset of CWE |
| CWE 2.11 | CWE-331, Insufficient Entropy | 2017-06-28: CERT: Exact |
CERT-CWE Mapping Notes
Key here for mapping notes
...
MSC30-C, MSC32-C and CON33-C are independent, they have no intersections. They each specify distinct errors regarding PRNGs.
Bibliography
...
...