JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
C and C++

HARDCODED.SEED : Hardcoded Seed in PRNG

要旨

A pseudorandom number generator (PRNG) is passed a hard-coded seed value.

If a PRNG is always initialized with the same seed, it will always produce the same sequence of values. If the resulting pseudorandom numbers are used in a security context, this represents a security risk.

See also Predictable Seed in PRNG.

プロパティ

クラス名 Hardcoded Seed in PRNG
日本語クラス名 Hardcoded Seed in PRNG
クラス分類 セキュリティ (security)
ニーモニック HARDCODED.SEED
カテゴリー
CWE CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)
CERT-C CERT-C:MSC32-C Properly seed pseudorandom number generators
  CERT-C:MSC41-C Never hard code sensitive information
CERT-CPP CERT-CPP:MSC51-CPP Ensure your random number generator is properly seeded
OWASP-2017 OWASP-2017:A6 Security misconfiguration
OWASP-2021 OWASP-2021:A2 Cryptographic failures
  OWASP-2021:A5 Security misconfiguration
OWASP-2025 OWASP-2025:A02 Security Misconfiguration
  OWASP-2025:A04 Cryptographic Failures
対応言語 C および C++ で利用可能です。
有効/無効設定 このワーニングクラスのチェックはデフォルトで有効になっています。チェックを無効にするにはプロジェクト設定ファイル （configuration file）に以下の WARNING_FILTER ルールを追加してください。 
WARNING_FILTER += discard class="Hardcoded Seed in PRNG"

例 

#include <stdlib.h>
#include <stdio.h>

unsigned int my_hardcoded_seed(void){return 5;}
unsigned int my_random_seed(void);                            /* defined elsewhere; doesn't return a hardcoded value */

void test_hardcoded_seed(void){
  int i;
  srand(5);                    /* 'Hardcoded Seed in PRNG' warning issued here */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());    /* the same sequence of 10 numbers is printed here every time test_hardcoded_seed() is called */
  }

  srand(my_hardcoded_seed());  /* 'Hardcoded Seed in PRNG' warning issued here */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());    /* the same sequence of 10 numbers is printed here every time test_hardcoded_seed() is called */
  }

  srand(my_random_seed());                                /* ok: seed is not hardcoded */
  for (i = 0; i<10; i++){
    printf("%d\n", rand());
  }
}

注釈

This class is defined using HARDCODED_ARGS_* rules in the general template configuration file, and covers various common procedures that take PRNG seed parameters. For a full list, see the "Factory Settings" in the documentation for HARDCODED_ARGS_*.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。

 

To report problems with this documentation, please visit https://support.codesecure.com/.