True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
View on MITREThe rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.
A program may crash or block if it runs out of random numbers.
Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.
No detection method information available for this CWE.
This code uses a TRNG to generate a unique session id for new connections to a server:
This code does not attempt to limit the number of new connections or make sure the TRNG can successfully generate a new random number. An attacker may be able to create many new connections and exhaust the entropy of the TRNG. The TRNG may then block and cause the program to crash or hang.
CWE-333: Improper Handling of Insufficient Entropy in TRNG is a Common Weakness Enumeration (CWE) entry maintained by MITRE. True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block. The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.
If exploited, CWE-333 (Improper Handling of Insufficient Entropy in TRNG) it can compromise Availability, leading to outcomes such as DoS: Crash, Exit, or Restart.
Recommended mitigations for CWE-333 include: Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.
CWE-333 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-333 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.