What’s Vulnerable › Vulnerabilities

CVE-2020-16166

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-30 · updated 2026-06-17
• Weakness: CWE-330

Description

The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04
• Debian Linux: 9.0
• Fedoraproject Fedora: 31, 32
• Linux kernel: through 5.7.11
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 9.5
• NetApp Cloud Volumes Ontap Mediator: all versions
• E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.60.3
• NetApp H410C Firmware: all versions
• NetApp Hci Bootstrap Os: all versions
• NetApp Hci Management Node: all versions
• NetApp Solidfire: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions
• NetApp StorageGRID: through 9.0.4
• openSUSE Leap: 15.1, 15.2
• Oracle Corporation SD-WAN Edge: 8.2

References

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
• https://arxiv.org/pdf/2012.07432.pdf
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f227e3ec3b5cad859ad15666874405e8c1bbc1d4
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c51f8f88d705e06bd696d7510aff22b33eb8e638
• https://github.com/torvalds/linux/commit/f227e3ec3b5cad859ad15666874405e8c1bbc1d4
• https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
• https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
• https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAPTLPAEKVAJYJ4LHN7VH4CN2W75R2YW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFBCLQWJI5I4G25TVJNLXLAXJ4MERQNW/
• https://security.netapp.com/advisory/ntap-20200814-0004/

Get alerted when CVE-2020-16166 or the next vulnerability affects your stack