SEI CERT C++ Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 51

changes.mady.by.user Will Snavely

Saved on

compared with

New Version Current

changes.mady.by.user Jill Britton

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
1st run: 3921124303, 1253168518, 1183339582, 197772533, 83186419, 2599073270, 3238222340, 101548389, 296330365, 3335314032, 
2nd run: 2392369099, 2509898672, 2135685437, 3733236524, 883966369, 2529945396, 764222328, 138530885, 4209173263, 1693483251, 
3rd run: 914243768, 2191798381, 2961426773, 3791073717, 2222867426, 1092675429, 2202201605, 850375565, 3622398137, 422940882,
...

Risk Assessment

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

MSC51-CPP

Medium

Likely

Low

P18

L1

Automated Detection

Tool

Version

Checker

Description

   
Astrée

Include Page
Astrée_V
Astrée_V

default-construction
Partially checked
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC++-MSC51
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

HARDCODED.SEED
MISC.CRYPTO.TIMESEED

Hardcoded Seed in PRNG
Predictable Seed in PRNG

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C++5041
Klocwork
Include Page
Klocwork_V
Klocwork_V
AUTOSAR.STDLIB.RANDOM.NBR_GEN_DEFAULT_INIT
Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C++: MSC51-CPP

Checks for:

  • Deterministic random output from constant seed
  • Predictable random output from predictable seed

Rule partially covered.

Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_CPP-MSC51-a

Properly seed pseudorandom number generators

PVS-Studio

Include Page
PVS-Studio_V
PVS-Studio_V

V1057
RuleChecker
Include Page
RuleChecker_V
RuleChecker_V
default-construction
Partially checked
 

Related Vulnerabilities

Using a predictable seed value, such as the current time, result in numerous vulnerabilities, such as the one described by CVE-2008-1637.

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

SEI CERT C Coding StandardMSC32-C. Properly seed pseudorandom number generators
MITRE CWE

CWE-327, Use of a Broken or Risky Cryptographic Algorithm

CWE-330, Use of Insufficiently Random Values

CWE-337, Predictable Seed in PRNG

Bibliography

[ISO/IEC 9899:2011]Subclause 7.22.2, "Pseudo-random Sequence Generation Functions"
[ISO/IEC 14882-2014]Subclause 26.5, "Random Number Generation"

...


...