Lucene search

K
osvGoogleOSV:GHSA-M9M5-CG5H-R582
HistoryAug 25, 2021 - 8:50 p.m.

Improper random number generation in nanorand

2021-08-2520:50:24
Google
osv.dev
8
nanorand
random number generation
versions
0.5.1
randomgen
unsigned integers
bit-shifting
64-bit number
as conversion
rngs
cryptographically secure
chacha
software

EPSS

0.002

Percentile

60.7%

In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the cryptographically secure ChaCha random number generator.

EPSS

0.002

Percentile

60.7%

Related for OSV:GHSA-M9M5-CG5H-R582