CWEweakness

CWE-333 Improper Handling of Insufficient Entropy in TRNG

Low Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Likelihood of exploit
Low
Languages
Not Language-Specific
CWE version
5.0

Description

True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.

Common consequences

• Availability: DoS: Crash, Exit, or Restart — A program may crash or block if it runs out of random numbers.

Potential mitigations

• [Implementation] Since the rate at which true random numbers can be generated is limited, it is important that one uses them only when they are needed for security. • [Implementation] Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.

Related

Child of · CWE (2)

  • CWE-331 Insufficient Entropy weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

Referenced by CVE · weakness (1)

  • CVE-2025-62626 Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED… vulnerability