Debian OpenSSL PRNG Predictability Bug

Incident Overview

In May 2008, Debian announced that the PRNG in its OpenSSL package had been broken since September 2006. The only random seed remaining was the process ID (PID), capped at 32,768, allowing attackers to pre-compute all possible global keypairs.

Technical Root Cause Analysis

A maintainer removed two lines of code in OpenSSL (`MD_Update(&m, &buf, n)`) to fix Valgrind uninitialized memory warnings, eliminating uninitialized stack memory from the PRNG entropy pool.

• Removed Entropy Code: `MD_Update(&m, &buf, n);` was commented out because Valgrind flagged reading uninitialized stack memory as a warning.
• PID Entropy Collapse: The PRNG state depended solely on `getpid()`. On Linux, PIDs max out at 32,768 by default.
• Pre-computed Exploitation: Attackers generated pre-computed public key lookup tables and scanned SSH servers worldwide, gaining instant root shell access.

Fatal Code Removal in OpenSSL md_rand.c

/* Commented out by Debian maintainer to quiet Valgrind: */
/* MD_Update(&m, &buf, n); */

/* Result: PRNG entropy pool initialized ONLY with process ID (0 to 32767) */
unsigned long pid = getpid();
MD_Update(&m, &pid, sizeof(pid));

Incident Timeline