CWE-339
Small Seed Space in PRNG
VariantDraft
Description
A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.
PRNGs are entirely deterministic once seeded, so it should be extremely difficult to guess the seed. If an attacker can collect the outputs of a PRNG and then brute force the seed by trying every possibility to see which seed matches the observed output, then the attacker will know the output of any subsequent calls to the PRNG. A small seed space implies that the attacker will have far fewer possible values to try to exhaust all possibilities.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (2)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-2815 | Hig | 0.00 | — | 0.00 | Jun 25, 2026 | Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys | ||
| CVE-2024-10026 | Med | 0.00 | 5.3 | 0.00 | Jan 30, 2025 | A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances. |
- risk 0.00cvss —epss 0.00
Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys
- risk 0.00cvss 5.3epss 0.00
A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.