Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Hit that exact bug with a customer at work in libvirt. Two machines booted at approximately the same time generated a VM with the same Mac. Due to very poor choices of random seed using the boot time and PID and xoring which made that even less random.

Details here: https://bugs.launchpad.net/bugs/1710341

It was since fixed though I never updated the bug.

src/util/virrandom.c:virRandomOnceInit seeds the random number generator using this formula: unsigned int seed = time(NULL) ^ getpid();

This seems to be a popular method after a quick google but it's easy to see how this can be problematic. The time is only in seconds, and during boot of a relatively identical system these numbers are both likely to be relatively similar across multiple systems which is quite likely in cloud-like environments. Secondly, by using bitwise OR only a small difference is created and if the 1st or 2nd MSB of the pid or time are 0 then it would be easy to have colliding values.

Though problematic from basic logic, I also tested this with a small test program trying 67,921 unique combinations of time() and pid() which produced only 5,693 random seeds using PID range 6799-6810 and time() range 1502484340 to 1502489999.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: