{"record":{"id":"e076a67817ba71d1","repo":"hyperledger/fabric","slug":"error-getting-random-bytes","errorCode":null,"errorMessage":"error getting random bytes","messagePattern":"error getting random bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"common/crypto/random.go","lineNumber":36,"sourceCode":"\nimport (\n\t\"crypto/rand\"\n\n\t\"github.com/pkg/errors\"\n)\n\nconst (\n\t// NonceSize is the default NonceSize\n\tNonceSize = 24\n)\n\n// GetRandomBytes returns len random looking bytes\nfunc GetRandomBytes(len int) ([]byte, error) {\n\tkey := make([]byte, len)\n\n\t_, err := rand.Read(key)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"error getting random bytes\")\n\t}\n\n\treturn key, nil\n}\n\n// GetRandomNonce returns a random byte array of length NonceSize\nfunc GetRandomNonce() ([]byte, error) {\n\treturn GetRandomBytes(NonceSize)\n}\n","sourceCodeStart":18,"sourceCodeEnd":46,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/crypto/random.go#L18-L46","documentation":"GetRandomBytes reads len bytes from crypto/rand and wraps any read failure with 'error getting random bytes'. This means the OS CSPRNG failed, which is nearly fatal for security-sensitive operations like nonce generation.","triggerScenarios":"Calling GetRandomBytes (or GetRandomNonce, which calls it) when rand.Read fails — e.g. exhausted entropy or a broken /dev/urandom on Linux, or file-descriptor exhaustion.","commonSituations":"Containers with restricted /dev/urandom access; systems under entropy starvation on old kernels; fd leaks causing open failures of the random source; misconfigured sandbox/seccomp profiles blocking getrandom(2).","solutions":["Fix the OS entropy/random device access (check /dev/urandom exists and is readable in the container)","Check ulimit/file-descriptor exhaustion (lsof, ulimit -n) and fix leaks","Upgrade kernel/host so getrandom(2) never blocks; modern kernels do not have entropy starvation","Retry the operation once the host random source is healthy — do not substitute math/rand"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// sanity check host randomness before relying on it\nif f, err := os.Open(\"/dev/urandom\"); err != nil { log.Fatal(\"no entropy source\") } else { f.Close() }","typeGuard":null,"tryCatchPattern":"nonce, err := crypto.GetRandomNonce()\nif err != nil {\n    if strings.Contains(err.Error(), \"error getting random bytes\") {\n        // log root cause, alert, and back off; do NOT fall back to math/rand\n        return nil\n    }\n}","preventionTips":["Never substitute math/rand or static values for CSPRNG failures","Monitor container fd limits and /dev/urandom availability","Run modern kernels where getrandom(2) never blocks"],"tags":["crypto","random","entropy"],"backgroundTag":"entropy-source-failure","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}