C and C++

HARDCODED.SEED : Hardcoded Seed in PRNG

要旨

A pseudorandom number generator (PRNG) is passed a hard-coded seed value.

If a PRNG is always initialized with the same seed, it will always produce the same sequence of values. If the resulting pseudorandom numbers are used in a security context, this represents a security risk.

See also Predictable Seed in PRNG.

プロパティ

クラス名 Hardcoded Seed in PRNG
日本語クラス名 Hardcoded Seed in PRNG
クラス分類 セキュリティ (security)
ニーモニック HARDCODED.SEED
カテゴリー
CWE CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)
CERT-C CERT-C:MSC32-C Properly seed pseudorandom number generators
  CERT-C:MSC41-C Never hard code sensitive information
CERT-CPP CERT-CPP:MSC51-CPP Ensure your random number generator is properly seeded
OWASP-2017 OWASP-2017:A6 Security misconfiguration
OWASP-2021 OWASP-2021:A5 Security misconfiguration
対応言語 C および C++ で利用可能です。
有効/無効設定 このワーニングクラスのチェックはデフォルトで有効になっています。チェックを無効にするにはプロジェクト設定ファイル （configuration file）に以下の WARNING_FILTER ルールを追加してください。 
WARNING_FILTER += discard class="Hardcoded Seed in PRNG"

例 

#include <stdlib.h>
#include <stdio.h>

unsigned int my_hardcoded_seed(){return 5;}
unsigned int my_random_seed();                            /* defined elsewhere; doesn't return a hardcoded value */

void test_hardcoded_seed(){
  int i;
  srand(5);                    /* 'Hardcoded Seed in PRNG' warning issued here */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());    /* the same sequence of 10 numbers is printed here every time test_hardcoded_seed() is called */
  }

  srand(my_hardcoded_seed());  /* 'Hardcoded Seed in PRNG' warning issued here */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());    /* the same sequence of 10 numbers is printed here every time test_hardcoded_seed() is called */
  }

  srand(my_random_seed());                                /* ok: seed is not hardcoded */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());
  }
}

注釈

This class is defined using HARDCODED_ARGS_* rules in the general template configuration file, and covers various common procedures that take PRNG seed parameters. For a full list, see the "Factory Settings" in the documentation for HARDCODED_ARGS_*.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。