Windows entropy initialization loads NETAPI32 from the process DLL search path

The Windows slow entropy gatherer loads NETAPI32.DLL by bare name, so selection depends on the host process's ambient DLL-search policy. In a deployment where an attacker-writable application or configured DLL directory precedes the genuine module -- and KnownDLL handling does not resolve it first -- the first entropy poll can execute attacker code at the consumer's privilege level.

Vulnerable code

random/rndw32.c, slow_gatherer:

c
      /* Initialize the NetAPI32 function pointers if necessary */
      hNetAPI32 = LoadLibrary ("NETAPI32.DLL");
      if (hNetAPI32)
        {
          if (debug_me)
            log_debug ("rndw32#slow_gatherer: netapi32 loaded\n" );
          pNetStatisticsGet = (NETSTATISTICSGET)(void *)
            GetProcAddress (hNetAPI32, "NetStatisticsGet");
          pNetApiBufferSize = (NETAPIBUFFERSIZE)(void *)
            GetProcAddress (hNetAPI32, "NetApiBufferSize");
          pNetApiBufferFree = (NETAPIBUFFERFREE)(void *)
            GetProcAddress (hNetAPI32, "NetApiBufferFree");

Why it matters

DllMain runs when LoadLibrary maps the image, before the three export checks can reject it. A privileged service or elevated desktop application whose installation directory is user-writable can therefore turn ordinary random generation into local privilege escalation. Modern safe-search defaults and a platform's KnownDLL set may prevent planting in a particular deployment; the source does not require either protection, and explicit process DLL directories remain relevant. This was established statically because the audit environment had no Windows runtime.

Proposed fix

Use LoadLibraryExW(L"netapi32.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32) and fail closed if a restricted system-directory load is unavailable. For legacy targets, build a checked absolute path from GetSystemDirectoryW. Add a Windows regression that places a marker DLL in the application/configured DLL directory and verifies it is never initialized, then confirms the loaded module path is under System32.