CWE-332 (PRNG中信息熵不充分) — Vulnerability Class 3

CWE-332 represents a critical weakness where a Pseudo-Random Number Generator lacks sufficient entropy, resulting in predictable output sequences that compromise system security. This flaw typically enables attackers to guess cryptographic keys, session tokens, or initialization vectors by analyzing the limited randomness source. When the underlying entropy pool is insufficient or poorly seeded, the generated numbers become deterministic rather than truly random, allowing adversaries to reconstruct internal states or brute-force sensitive values with significantly reduced computational effort. To mitigate this risk, developers must ensure their PRNGs are seeded with high-quality, unpredictable data from robust operating system entropy sources, such as hardware random number generators or kernel-provided entropy pools. Avoiding static seeds and regularly updating the entropy source during runtime are essential practices to maintain cryptographic strength and prevent exploitation of predictable generation patterns.