C and C++

HARDCODED.SEED : Hardcoded Seed in PRNG

Summary

A pseudorandom number generator (PRNG) is passed a hard-coded seed value.

If a PRNG is always initialized with the same seed, it will always produce the same sequence of values. If the resulting pseudorandom numbers are used in a security context, this represents a security risk.

See also Predictable Seed in PRNG.

Properties

Class Name Hardcoded Seed in PRNG
Significance security
Mnemonic HARDCODED.SEED
Categories
CWE CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)
CERT-C CERT-C:MSC32-C Properly seed pseudorandom number generators
  CERT-C:MSC41-C Never hard code sensitive information
CERT-CPP CERT-CPP:MSC51-CPP Ensure your random number generator is properly seeded
OWASP-2017 OWASP-2017:A6 Security misconfiguration
OWASP-2021 OWASP-2021:A5 Security misconfiguration
Availability Available for C and C++.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Hardcoded Seed in PRNG"

Example 

#include <stdlib.h>
#include <stdio.h>

unsigned int my_hardcoded_seed(){return 5;}
unsigned int my_random_seed();                            /* defined elsewhere; doesn't return a hardcoded value */

void test_hardcoded_seed(){
  int i;
  srand(5);                    /* 'Hardcoded Seed in PRNG' warning issued here */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());    /* the same sequence of 10 numbers is printed here every time test_hardcoded_seed() is called */
  }

  srand(my_hardcoded_seed());  /* 'Hardcoded Seed in PRNG' warning issued here */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());    /* the same sequence of 10 numbers is printed here every time test_hardcoded_seed() is called */
  }

  srand(my_random_seed());                                /* ok: seed is not hardcoded */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());
  }
}

Notes

This class is defined using HARDCODED_ARGS_* rules in the general template configuration file, and covers various common procedures that take PRNG seed parameters. For a full list, see the "Factory Settings" in the documentation for HARDCODED_ARGS_*.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.